AI agent vulnerability · OpenClaw

CVE-2026-27003: OpenClaw: Telegram bot token exposure via logs

mediumCVSS 4.0 6.9GHSA-chf7-jq6g-qrwv

Vulnerability Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include https://api.telegram.org/bot /...). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Impact Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access.

Published Feb 18, 2026 · Updated Feb 20, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.15
Fixed in: 2026.2.15
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Vulnerability

Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include https://api.telegram.org/bot<token>/...). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles.

Impact

Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.14
Fixed: >= 2026.2.15 (next release)

Mitigation

Upgrade to openclaw >= 2026.2.15 when released.
Rotate the Telegram bot token if it may have been exposed.

Fix Commit(s)

cf6990701b258bb9cc4ac7f6c7bdf05016e7f6e46

Thanks @aether-ai-agent for reporting.

Credited to aether-ai-agent.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries