88289 matches found
CVE-2026-35661 OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...
EUVD-2026-21468
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...
CVE-2026-35661 OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...
CVE-2026-35661
CVE-2026-35661 affects OpenClaw prior to 2026.3.25. Affected component: Telegram callback query handling allows an authorization bypass that enables remote attackers to mutate session state without satisfying normal DM pairing. Attack requires no user interaction and network access (low complexit...
CVE-2026-35661
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...
GHSA-W5FQ-8965-C969
creationtimestamp| type| source ---|---|--- 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8...
GHSA-2WGG-7R2P-CMQX
creationtimestamp| type| source ---|---|--- 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8...
CVE-2026-5479
creationtimestamp| type| source ---|---|--- 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70...
CVE-2026-6004
creationtimestamp| type| source ---|---|--- 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70...
CVE-2026-5466
creationtimestamp| type| source ---|---|--- 2026-04-10 05:15:56+00:00| published-proof-of-concept| Telegram/1WdkdhXUJmGV7ePrqgJjIpgxUFBJfkFq-ncP6HWfcjVt70 2026-09-02 06:00:17+00:00| seen| https://t.me/RussianOSINT/7197 2026-09-03 00:00:44+00:00| seen| https://t.me/RussianOSINT/7197...
CVE-2026-35584
creationtimestamp| type| source ---|---|--- 2026-04-10 05:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/79698 2026-04-10 07:00:15+00:00| published-proof-of-concept| Telegram/4UpY9ng-1B7fl4pW8rF9tQFphK5boVLlHwZbJ8KZ6vXJanY 2026-04-10 09:00:05+00:00| published-proof-of-concept...
CVE-2026-29861
creationtimestamp| type| source ---|---|--- 2026-04-10 03:00:04+00:00| seen| https://t.me/GithubRedTeam/79673...
CVE-2026-5985
creationtimestamp| type| source ---|---|--- 2026-04-10 01:19:02+00:00| seen| Telegram/r2aLRB54IhOSR-P7tVQ1PquPIQ5c0jGeGUejuuUUcNPCN8...
GHSA-R4C2-GQ3J-7RPJ Duplicate Advisory: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vcx4-4qxg-mfp4. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allo...
Duplicate Advisory: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vcx4-4qxg-mfp4. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allo...
EUVD-2026-21114
OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without throttling, permitting attackers to systematically guess webhook...
PT-2026-31972
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...
OpenClaw security vulnerabilities
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.25 contained security vulnerabilities. These vulnerabilities stemmed from authorization bypasses in the Telegram inquiry processing mechanism, which could allow remote attackers...