p PatchFirst

CVE-2026-27003

CVE-2026-27003 · OpenClaw: Telegram bot token exposure via logs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot<token>/...`). Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Users should upgrade to version 2026.2.15 to obtain a fix and rotate the Telegram bot token if it may have been exposed.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • < 2026.2.15: Affected

    No fix published

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.2.15

    Update to 2026.2.15

Original sources

Check your server →