OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State
## Summary Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State ## Affected Packages / Versions - Package: `openclaw` - Affected versions: `<= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24` ## Details Telegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit `269282ac69ab6030d5f30d04822668f607f13065` enforces DM authorization for callbacks. Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `269282ac69ab6030d5f30d04822668f607f13065`. ## Fix Commit(s) - `269282ac69ab6030d5f30d04822668f607f13065`
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-35661US | —OT erhöht | — | ||
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/269282ac69ab6030d5f30d04822668f607f13065WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c9-w69r-cw33WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-35661ADVISORY
- https://www.vulncheck.com/advisories/openclaw-telegram-dm-scoped-inline-button-callback-authorization-bypassWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan