GHSA-j4c9-w69r-cw33MediumCVSS 5.3

OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

Published
March 29, 2026
Last Modified
April 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-35661 →

📋 Description

Summary

Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

Telegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit 269282ac69ab6030d5f30d04822668f607f13065 enforces DM authorization for callbacks.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 269282ac69ab6030d5f30d04822668f607f13065.

Fix Commit(s)

  • 269282ac69ab6030d5f30d04822668f607f13065

🎯 Affected products1

  • npm/openclaw:<= 2026.3.24

🔗 References (5)