CVE-2026-32980: OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request
OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32980?
CVE-2026-32980 has a high severity due to its potential to allow resource exhaustion of the server.
How do I fix CVE-2026-32980?
To fix CVE-2026-32980, upgrade to OpenClaw version 2026.3.13 or later, which includes a patch for this vulnerability.
What causes CVE-2026-32980?
CVE-2026-32980 is caused by OpenClaw reading and buffering Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header.
Who is affected by CVE-2026-32980?
CVE-2026-32980 affects all versions of OpenClaw prior to 2026.3.13.
Can CVE-2026-32980 be exploited remotely?
Yes, CVE-2026-32980 can be exploited remotely by unauthenticated attackers who send crafted Telegram webhook requests.