CVE-2026-28480
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Mar 5, 2026
CISA due date
—
The record
OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with bots as unauthorized senders.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | clawdbot | 0 | No fix |
| npm | openclaw | 0 | 2026.2.14 |
Related vulnerabilities
- GHSA-mj5r-hh7j-4gxf OpenClaw Telegram allowlist authorization accepted mutable usernames Same vulnerability
- CVE-2026-29612 OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers… Also affects clawdbot
- CVE-2026-28478 OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook… Also affects clawdbot
- CVE-2026-28469 OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the… Also affects clawdbot
- CVE-2026-28452 OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the… Also affects clawdbot
- CVE-2026-26328 OpenClaw is a personal AI assistant. Also affects clawdbot
- CVE-2026-26317 OpenClaw is a personal AI assistant. Also affects clawdbot
- GHSA-rq6g-px6m-c248 OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account… Also affects clawdbot