OpenClaw Telegram allowlist authorization accepted mutable usernames

中 6.5CVE-2026-28480 · GHSA-mj5r-hh7j-4gxf · 05/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-28480 は openclaw (openclaw), clawdbot, openclaw に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.24%（全脆弱性の 15.6% より高い）。
対処：2026.2.14 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
openclaw openclaw	`< 2026.2.14`	`2026.2.14`
clawdbot npm	`≤ 2026.1.24-3`	修正版なし
openclaw npm	`< 2026.2.14`	`2026.2.14`

概要

Summary

Telegram allowlist authorization could match on @username (mutable/recyclable) instead of immutable numeric sender IDs.

Impact

Operators who treat Telegram allowlists as strict identity controls could unintentionally grant access if a username changes hands (identity rebinding/spoof risk). This can allow an unauthorized sender to interact with the bot in allowlist mode.

Affected Packages / Versions

npm openclaw: <= 2026.2.13
npm clawdbot: <= 2026.1.24-3

Fix

Telegram allowlist authorization now requires numeric Telegram sender IDs only. @username allowlist principals are rejected.

A security audit warning was added to flag legacy configs that still contain non-numeric Telegram allowlist entries.

openclaw doctor --fix now attempts to resolve @username allowFrom entries to numeric IDs (best-effort; requires a Telegram bot token).

Fix Commit(s)

e3b432e481a96b8fd41b91273818e514074e05c3
9e147f00b48e63e7be6964e0e2a97f2980854128

Thanks @vincentkoc for reporting.

NVD の説明

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with bots as unauthorized senders.