OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State
## Summary Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State ## Affected Packages / Versions - Package: `openclaw` - Affected versions: `<= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24` ## Details Telegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit `269282ac69ab6030d5f30d04822668f607f13065` enforces DM authorization for callbacks. Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `269282ac69ab6030d5f30d04822668f607f13065`. ## Fix Commit(s) - `269282ac69ab6030d5f30d04822668f607f13065`
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-35661US | —OT elevated | — | ||
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/269282ac69ab6030d5f30d04822668f607f13065WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c9-w69r-cw33WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-35661ADVISORY
- https://www.vulncheck.com/advisories/openclaw-telegram-dm-scoped-inline-button-callback-authorization-bypassWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan