OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. …

Published:

30 maart 2026 om 22:00:00

Alert date:

31 maart 2026 om 13:04:59

Source:

nvd.nist.gov

Enterprise Applications, Email & Messaging

OpenClaw before version 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function. The vulnerability exposes Telegram bot tokens in error messages when media downloads fail. The original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces. This represents a significant security risk as exposed bot tokens could allow unauthorized access to Telegram bot functionality. The vulnerability has been addressed in version 2026.3.13 and later.

Technical details

Mitigation steps:

Affected products:

OpenClaw