We use cookies to improve your experience on our site.
AVID-2026-R0237
Description
OpenClaw: Telegram bot token exposure via logs (CVE-2026-27003)
Details
OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include https://api.telegram.org/bot<token>/...). Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Users should upgrade to version 2026.2.15 to obtain a fix and rotate the Telegram bot token if it may have been exposed.
References
- NVD entry
- https://github.com/openclaw/openclaw/security/advisories/GHSA-chf7-jq6g-qrwv
- https://github.com/openclaw/openclaw/commit/cf69907015b659e5025efb735ee31bd05c4ee3d5
- OpenClawCVEs repository
Affected or Relevant Artifacts
- Developer: openclaw
- Deployer: openclaw
- Artifact Details:
| Type | Name |
|---|---|
| System | openclaw |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CWE
| ID | Description |
|---|---|
| CWE-522 | CWE-522: Insufficiently Protected Credentials |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2026-02-19
- Version: 0.3.2
- AVID Entry