CVE-2026-28480

mediumpriority · track · 0EPSS 0.002 · 13 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.22% (13th) EPSS
CVSS 6.5 · medium
Is it mine?
7 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with bots as unauthorized senders.

01

cvss

Technical severity, 0–10. One row per scoring source.

6.9
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.9

v3.16.5mediumAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · disclosure@vulncheck.comexploitability 3.9 · impact 2.5
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:Nsecondary · OSV
v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com
v4.02.7lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-290USCWE-290USCWE-290US
04

affected products (7)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2026-0424OpenClaw: Mehrere SchwachstellenDeutsch2026-02-15csaf · cert_bundDE

    Ein Angreifer kann diese Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.

  • GHSA-mj5r-hh7j-4gxfOpenClaw Telegram allowlist authorization accepted mutable usernames2026-02-18ghsa · osvUS

    ## Summary Telegram allowlist authorization could match on `@username` (mutable/recyclable) instead of immutable numeric sender IDs. ## Impact Operators who treat Telegram allowlists as strict identity controls could unintentionally grant access if a username changes hands (identity rebinding/spoof risk). This can allow an unauthorized sender to interact with the bot in allowlist mode. ## Affected Packages / Versions - npm `openclaw`: <= 2026.2.13 - npm `clawdbot`: <= 2026.1.24-3 ## Fix Telegram allowlist authorization now requires numeric Telegram sender IDs only. `@username` allowlist principals are rejected. A security audit warning was added to flag legacy configs that still contain non-numeric Telegram allowlist entries. `openclaw doctor --fix` now attempts to resolve `@username` allowFrom entries to numeric IDs (best-effort; requires a Telegram bot token). ## Fix Commit(s) - e3b432e481a96b8fd41b91273818e514074e05c3 - 9e147f00b48e63e7be6964e0e2a97f2980854128 Thanks @vincentkoc for reporting.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundnvdosvNVDCVE.orgMITRE
published 2026-03-05modified 2026-06-17
08

references (13)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan