{"id":"GHSA-mj5r-hh7j-4gxf","summary":"OpenClaw Telegram allowlist authorization accepted mutable usernames","details":"## Summary\nTelegram allowlist authorization could match on `@username` (mutable/recyclable) instead of immutable numeric sender IDs.\n\n## Impact\nOperators who treat Telegram allowlists as strict identity controls could unintentionally grant access if a username changes hands (identity rebinding/spoof risk). This can allow an unauthorized sender to interact with the bot in allowlist mode.\n\n## Affected Packages / Versions\n- npm `openclaw`: \u003c= 2026.2.13\n- npm `clawdbot`: \u003c= 2026.1.24-3\n\n## Fix\nTelegram allowlist authorization now requires numeric Telegram sender IDs only. `@username` allowlist principals are rejected.\n\nA security audit warning was added to flag legacy configs that still contain non-numeric Telegram allowlist entries.\n\n`openclaw doctor --fix` now attempts to resolve `@username` allowFrom entries to numeric IDs (best-effort; requires a Telegram bot token).\n\n## Fix Commit(s)\n- e3b432e481a96b8fd41b91273818e514074e05c3\n- 9e147f00b48e63e7be6964e0e2a97f2980854128\n\nThanks @vincentkoc for reporting.","aliases":["CVE-2026-28480"],"modified":"2026-03-06T01:18:29.664702Z","published":"2026-02-18T00:54:32Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-02-18T00:54:32Z","nvd_published_at":"2026-03-05T22:16:22Z","cwe_ids":["CWE-284","CWE-290"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mj5r-hh7j-4gxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28480"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/9e147f00b48e63e7be6964e0e2a97f2980854128"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/e3b432e481a96b8fd41b91273818e514074e05c3"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/openclaw-identity-spoofing-via-mutable-username-in-telegram-allowlist-authorization"}],"affected":[{"package":{"name":"openclaw","ecosystem":"npm","purl":"pkg:npm/openclaw"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.14"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mj5r-hh7j-4gxf/GHSA-mj5r-hh7j-4gxf.json"}},{"package":{"name":"clawdbot","ecosystem":"npm","purl":"pkg:npm/clawdbot"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2026.1.24-3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mj5r-hh7j-4gxf/GHSA-mj5r-hh7j-4gxf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}