GHSA-h656-5vcf-cm23
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
Medium
npm
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-208 Observable Timing Discrepancy
- CWE-404 Improper Resource Shutdown or Release
- CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
- CWE-770 Allocation of Resources Without Limits or Throttling
- Fix
2026.2.24- Upgrade openclaw to this version or later
Description
Impact
In Telegram DM mode, inbound media was downloaded and written to disk before sender authorization checks completed. An unauthorized sender could trigger inbound media download/write activity (including media groups) even when DM access should be denied.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published version currently affected:
2026.2.23 - Vulnerable range:
<= 2026.2.23 - Patched in planned next release:
2026.2.24
Fix Commit(s)
9514201fb9b51de5d0b23151110d0ff5d9c8bd67
Technical Details
The Telegram handler flow now enforces DM authorization before media download/write paths execute, including media-group handling. Inbound channel activity tracking was also moved to run after DM authorization in the Telegram message context path.
Release Process Note
patched_versions is pre-set to the planned next release (2026.2.24). After npm publish, the advisory can be published without further version-field edits.
OpenClaw thanks @v8hid for reporting.
Publication Update (2026-02-25)
openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| openclaw | < 2026.2.24 |
2026.2.24 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
openclaw npm → 2026.2.24
- npm
npm install openclaw@2026.2.24- yarn
yarn add openclaw@2026.2.24- pnpm
pnpm add openclaw@2026.2.24
Weakness
CWE-208: Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-404: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
- Implementation: It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
- Implementation: Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
- Implementation: When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
How to prevent it
- Architecture and Design: An application must make network resources available to a client commensurate with the client's access level.
- Policy: Define a clear policy for network resource allocation and consumption.
- Implementation: An application must, at all times, keep track of network resources and meter their usage appropriately.
CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
How to prevent it
- Requirements: Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
- Architecture and Design: Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
- Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place, and it will help the administrator to identify who is committing the abuse. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, typically by using increasing time delays uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution can be difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply requires more resources on the part of the attacker.
- Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
- Architecture and Design, Implementation: If the program must fail, ensure that it fails gracefully (fails closed). There may be a temptation to simply let the program fail poorly in cases such as low memory conditions, but an attacker may be able to assert control before the software has fully exited. Alternately, an uncontrolled failure could cause cascading problems with other downstream components; for example, the program could send a signal to a downstream process so the process immediately knows that a problem has occurred and has a better chance of recovery. Ensure that all failures in resource allocation place the system into a safe posture.
- Operation, Architecture and Design: Use quotas or other resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available. However, these functions are not available on all operating systems. When the current levels get close to the maximum that is defined for the application (see CWE-770), then limit the allocation of further resources to privileged users; alternately, begin releasing resources for less-privileged users. While this mitigation may protect the system from attack, it will not necessarily stop attackers from adversely impacting other users. Ensure that the application performs the appropriate error checks and error handling in case resources become unavailable (CWE-703).
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-3x84-qq85-fj65 OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs | High | Also affects openclaw |
| GHSA-9c3v-684m-579c OpenClaw MCP SSE redirects could forward Authorization headers | Medium | Also affects openclaw |
| GHSA-f397-5vjw-v2c2 OpenClaw: Shell inline-command parsing could miss an allowlist check | High | Also affects openclaw |
| GHSA-rx78-29qr-5hq8 OpenClaw: Workspace-derived service PATH could influence trash command selection | High | Also affects openclaw |
| GHSA-ccwh-wwpp-6wg5 OpenClaw: Host environment sanitizer missed two Node.js control variables | High | Also affects openclaw |
| GHSA-985f-72mj-8gf7 OpenClaw: Tool group policy callers could accept unvalidated group IDs | Medium | Also affects openclaw |
| GHSA-9v8j-9c9g-w66c OpenClaw: Bootstrap token replay could widen pending pairing scopes | Medium | Also affects openclaw |
| GHSA-c226-q6fx-6j6c OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags | Medium | Also affects openclaw |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor