In short
- CVE-2026-27003 is a MEDIUM (CVSS 5.5) vulnerability affecting openclaw (openclaw), openclaw.
- Chance of exploitation in the next 30 days (EPSS): 0.16%, higher than 5.3% of all vulnerabilities.
- Fix: update to 2026.2.15 or later.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.2.15
| 2026.2.15
|
| openclaw npm | < 2026.2.15
| 2026.2.15
|
Description
Vulnerability
Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include https://api.telegram.org/bot<token>/...). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles.
Impact
Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected:
<= 2026.2.14
- Fixed:
>= 2026.2.15 (next release)
Mitigation
- Upgrade to
openclaw >= 2026.2.15 when released.
- Rotate the Telegram bot token if it may have been exposed.
Fix Commit(s)
- cf6990701b258bb9cc4ac7f6c7bdf05016e7f6e46
Thanks @aether-ai-agent for reporting.
NVD description
OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot<token>/...`). Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Users should upgrade to version 2026.2.15 to obtain a fix and rotate the Telegram bot token if it may have been exposed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free