CVE-2026-25474: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25474 is an authentication bypass vulnerability in OpenClaw, a personal AI assistant, affecting its Telegram webhook integration. When channels.telegram.webhookSecret is not configured, OpenClaw versions 2026.1.30 and below may accept incoming webhook HTTP requests without verifying Telegram's secret token header (X-Telegram-Bot-Api-Secret-Token), allowing unauthenticated attackers to forge Telegram updates. The vulnerability was published on February 14, 2026, and patched in version 2026.2.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity): when channels.telegram.webhookUrl is configured but channels.telegram.webhookSecret is omitted, the application skips validation of the X-Telegram-Bot-Api-Secret-Token header that Telegram includes with legitimate webhook deliveries. An unauthenticated remote attacker with network access to the webhook endpoint can send crafted HTTP POST requests that mimic Telegram update payloads, including spoofed message.from.id fields. The fix involved four commits: enforcing config validation to require webhookSecret when webhookUrl is set, adding a runtime guard that throws an error if the secret is missing or empty at startup, defaulting the webhook listener bind host from 0.0.0.0 to 127.0.0.1 (loopback only), and enforcing bounded request body handling (GitHub Advisory, Commit ca92597, Commit 633fe8b).

An attacker who can reach the exposed webhook endpoint can inject forged Telegram update payloads that OpenClaw processes as if they originated from legitimate Telegram servers, including spoofing the sender identity (message.from.id). Depending on the bot's enabled commands, tools, and configuration, this could trigger unintended or unauthorized bot actions — such as executing privileged commands, accessing connected integrations, or manipulating bot behavior. There is no direct confidentiality or availability impact per the CVSS scoring, but integrity is rated High due to the ability to manipulate bot operations (GitHub Advisory).

A proof-of-concept reference exists via the GitHub security advisory, though no evidence of active in-the-wild exploitation has been reported. The vulnerability requires no authentication and no user interaction, and has low attack complexity — the only precondition is that the attacker can reach the webhook endpoint and that the target deployment uses Telegram webhook mode without a configured secret. Telegram webhook mode is not enabled by default; it activates only when channels.telegram.webhookUrl is set. The EPSS score is approximately 0.017% (9th percentile), indicating low predicted exploitation probability. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify OpenClaw deployments running in Telegram webhook mode by scanning for exposed HTTP endpoints (e.g., port 8787 with path /telegram-webhook) using tools like Shodan or Censys. Confirm the target is running OpenClaw version 2026.1.30 or earlier.
2. Verify missing secret: Attempt to send a test HTTP POST request to the webhook endpoint without the X-Telegram-Bot-Api-Secret-Token header. If the server responds with a 200 OK or processes the request rather than rejecting it, the secret is not configured.
3. Craft forged Telegram update: Construct a JSON payload mimicking a legitimate Telegram update object, spoofing the message.from.id field to impersonate a trusted user or administrator.
4. Send forged request: Submit the crafted payload via HTTP POST to the webhook endpoint (e.g., POST /telegram-webhook) without any authentication header.
5. Trigger bot action: The OpenClaw bot processes the forged update as if it came from Telegram, potentially executing commands or tools associated with the spoofed user identity, depending on the bot's configuration (GitHub Advisory).

• Network: Unexpected HTTP POST requests to the OpenClaw webhook endpoint (default: port 8787, path /telegram-webhook) originating from IP addresses other than Telegram's known server ranges; requests lacking the X-Telegram-Bot-Api-Secret-Token header.
• Logs: Application logs showing webhook requests processed without secret token validation; repeated POST requests to the webhook path from non-Telegram source IPs; unusual bot command executions logged shortly after webhook activity.
• Process/Application Behavior: Unexpected bot actions (e.g., command executions, tool invocations) that do not correspond to legitimate user interactions; bot responses directed at spoofed user IDs not present in the allowlist.

Upgrade OpenClaw to version 2026.2.1 or later, which enforces webhookSecret as a required field when webhookUrl is configured and adds a runtime guard that prevents webhook startup if the secret is absent or empty. If immediate upgrade is not possible, set a strong channels.telegram.webhookSecret value and ensure the reverse proxy forwards the X-Telegram-Bot-Api-Secret-Token header unchanged. Additionally, restrict network access to the webhook endpoint by binding it to loopback (127.0.0.1) and exposing it only through a trusted reverse proxy — this is now the default behavior in 2026.2.1. Disable Telegram webhook mode entirely if it is not actively required (GitHub Advisory, Commit 5643a93).

The vulnerability was reported by researcher @yueyueL and disclosed by the OpenClaw maintainer (steipete) via GitHub's security advisory process on February 14, 2026. A BeyondMachines digest noted the broader batch of security fixes in OpenClaw around the same time. No significant mainstream media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator entries.