要点
- CVE-2026-27003 是影响 openclaw (openclaw), openclaw 的中危 (CVSS 5.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.16%，高于 5.3% 的漏洞。
- 修复：升级到 2026.2.15 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.2.15
| 2026.2.15
|
| openclaw npm | < 2026.2.15
| 2026.2.15
|
Description
Vulnerability
Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include https://api.telegram.org/bot<token>/...). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles.
Impact
Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected:
<= 2026.2.14
- Fixed:
>= 2026.2.15 (next release)
Mitigation
- Upgrade to
openclaw >= 2026.2.15 when released.
- Rotate the Telegram bot token if it may have been exposed.
Fix Commit(s)
- cf6990701b258bb9cc4ac7f6c7bdf05016e7f6e46
Thanks @aether-ai-agent for reporting.
NVD description
OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot<token>/...`). Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Users should upgrade to version 2026.2.15 to obtain a fix and rotate the Telegram bot token if it may have been exposed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free