CVE-2026-28454

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-28454
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28454.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-28454
Aliases
Published
2026-03-05T21:59:31Z
Modified
2026-10-28T02:30:47Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook
Details

OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id and chat.id fields to bypass sender allowlists and execute privileged bot commands.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-345"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28454.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
95cd2210f93d6ab2acc5e29dbad6065294365863
Fixed
3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930
Fixed
5643a934799dc523ec2ef18c007e1aa2c386b670
Fixed
633fe8b9c17f02fcc68ecdb5ec212a5ace932f09
Fixed
ca92597e1f9593236ad86810b66633144b69314d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2026.2.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "5643a934799dc523ec2ef18c007e1aa2c386b670"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "633fe8b9c17f02fcc68ecdb5ec212a5ace932f09"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "ca92597e1f9593236ad86810b66633144b69314d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v1.*
v1.0.4
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v2.*
v2.0.0-beta1
v2.0.0-beta2
v2.0.0-beta3
v2.0.0-beta4
v2.0.0-beta5
v2026.*
v2026.1.10
v2026.1.11
v2026.1.11-1
v2026.1.11-2
v2026.1.11-3
v2026.1.12
v2026.1.12-2
v2026.1.13
v2026.1.14-1
v2026.1.15
v2026.1.16-2
v2026.1.20
v2026.1.21
v2026.1.22
v2026.1.23
v2026.1.24
v2026.1.24-1
v2026.1.29
v2026.1.30
v2026.1.5
v2026.1.5-1
v2026.1.5-2
v2026.1.5-3
v2026.1.8
v2026.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28454.json"