CVE-2026-27003: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27003 is a Telegram bot token exposure vulnerability in OpenClaw, a personal AI assistant npm package. Prior to version 2026.2.15, OpenClaw logged error messages and stack traces containing Telegram Bot API request URLs (e.g., https://api.telegram.org/bot<token>/...) without redacting the embedded token, potentially leaking credentials into application logs, crash reports, CI output, or support bundles. The vulnerability affects all OpenClaw versions up to and including 2026.2.14 for Node.js. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, OpenClaw Advisory).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials): OpenClaw's formatErrorMessage and formatUncaughtError functions in src/infra/errors.ts returned raw error strings and stack traces without sanitizing sensitive data. Because Telegram Bot API URLs embed the bot token in the path (/bot<token>/), any HTTP error or exception involving these URLs would expose the token verbatim in log output. The fix, introduced in commit cf69907, imports a redactSensitiveText function from src/logging/redact.ts and applies it to all formatted error and stack trace output; a new regex pattern (\bbot(\d{6,}:[A-Za-z0-9_-]{20,})\b) was added to the redaction pattern list to specifically match Telegram bot tokens (OpenClaw Commit, GitHub Advisory). Exploitation requires local access to log files, CI artifacts, crash reports, or support bundles where the unredacted output was stored.

Successful exploitation — obtaining the leaked Telegram bot token — allows an attacker to fully impersonate the bot and take over its Bot API access, enabling them to read messages sent to the bot, send arbitrary messages to users, modify bot behavior, and potentially access sensitive conversation data. There is no direct integrity or availability impact on the host system, but the confidentiality of the bot token and all data accessible through the Bot API is fully compromised. The scope of impact is limited to the Telegram bot's permissions and the conversations it participates in (GitHub Advisory, OpenClaw Advisory).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.014% (1st percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is passive in nature — an attacker with read access to logs, CI output, crash reports, or support bundles containing unredacted error messages could extract the token without any active attack against the running application.

1. Gain access to log artifacts: Obtain read access to application logs, CI pipeline output, crash reports, or support bundles generated by an OpenClaw instance running version ≤ 2026.2.14. This could be through misconfigured log storage, insider access, or leaked CI artifacts.
2. Search for Telegram token patterns: Grep or search the log files for the pattern api.telegram.org/bot or the token format \d{6,}:[A-Za-z0-9_-]{20,} to locate exposed bot tokens within error messages or stack traces.
3. Extract the bot token: Identify and copy the full token string (format: <numeric_id>:<alphanumeric_secret>) from the log entry.
4. Authenticate to the Telegram Bot API: Use the extracted token to make authenticated requests to the Telegram Bot API (e.g., https://api.telegram.org/bot<token>/getMe) to confirm token validity and bot identity.
5. Impersonate the bot: Use the token to call Bot API methods such as getUpdates to read pending messages, sendMessage to send messages to users, or other API endpoints within the bot's permission scope (GitHub Advisory, OpenClaw Advisory).

• Logs: Application log files or CI output containing strings matching api.telegram.org/bot<digits>:<alphanumeric>/ where the token is not redacted (i.e., not replaced with a truncated form like 123456…cdef).
• File System: Crash report files, support bundles, or exported log archives containing unredacted Telegram Bot API URLs in error messages or stack traces from OpenClaw versions ≤ 2026.2.14.
• Network: Unexpected or unauthorized API calls to https://api.telegram.org/bot<token>/ originating from IP addresses not associated with the legitimate bot host, which may indicate token abuse after exposure.
• Telegram Bot API: Unexpected getUpdates polling or message sends observed in Telegram bot activity logs that do not correspond to legitimate application behavior, potentially indicating token misuse by a third party.

Upgrade OpenClaw to version 2026.2.15 or later, which applies token redaction to all error messages and stack traces via the updated formatErrorMessage and formatUncaughtError functions (OpenClaw Commit, GitHub Advisory). If the bot token may have been exposed in logs, crash reports, CI output, or support bundles prior to upgrading, immediately rotate the Telegram bot token via BotFather to invalidate the compromised credential. As an interim measure before upgrading, restrict access to log files and CI artifacts to authorized personnel only, and audit existing logs for token exposure.

The vulnerability was reported by @aether-ai-agent and published by orlyjamie on February 18, 2026, with the fix committed the same day. No significant broader industry commentary, media coverage, or notable researcher reactions beyond the GitHub advisory and standard vulnerability database indexing have been identified for this moderate-severity issue (GitHub Advisory).