Brute-Force Vulnerability in OpenClaw Telegram Webhook: Weak Secret Exploitation

openclaw Updated 28 Mar 2026

Summary

27/03/2026

Disclosed on

MODERATE

Severity

No i

Fix available

Moderate

Severity

6.3

CVSS Score

GHSA-vcx4-4qxg-mfp4: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret Affected Packages / Versions - Package: openclaw - Affected versions:. Affects openclaw versions < 2026.3.24. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

OpenClaw is an open-source package designed for integrating Telegram webhooks into applications, enabling real-time communication and automation. It allows developers to set up Telegram bots that can respond to messages and events. However, a significant vulnerability exists in its webhook authentication mechanism, which could expose users to brute-force attacks if weak secrets are used.

Vulnerability Detail

The vulnerability arises from the lack of guess rate limiting on the Telegram webhook authentication process. Previously, the system would reject incorrect secrets but did not implement any throttling mechanism for repeated attempts. This oversight allows attackers to perform brute-force guessing of weak webhook secrets, potentially compromising the security of the Telegram bot. The vulnerability is identified in versions of OpenClaw up to 2026.3.24, with the fix implemented in version 2026.3.25.

How To Fix

No fixed version is published for this vulnerability.

To rectify this vulnerability, update the OpenClaw package to the patched version 2026.3.25 or later. You can do this by running the following command in your terminal: npm install openclaw@2026.3.25. This will ensure that the new throttling mechanism is in place, protecting against brute-force attempts.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

As a temporary workaround, consider using a strong, complex webhook secret that is less susceptible to brute-force attacks. Additionally, monitor your webhook logs for any unusual activity that may indicate brute-force attempts.

Conclusion

The OpenClaw package has a significant vulnerability related to its Telegram webhook authentication process, allowing for brute-force attacks on weak secrets. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.

See every vulnerability recorded for openclaw →