https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 16:31:07 +0000 https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-27003 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Vulnerability</p> <p>Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot&lt;token&gt;/...`). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles.</p> <p>## Impact</p> <p>Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.14` - Fixed: `&gt;= 2026.2.15` (next release)</p> <p>## Mitigation</p> <p>- Upgrade to `openclaw &gt;= 2026.2.15` when released. - Rotate the Telegram bot token if it may have been exposed.</p> <p>## Fix Commit(s)</p> <p>- cf6990701b258bb9cc4ac7f6c7bdf05016e7f6e46</p> <p>Thanks @aether-ai-agent for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Vulnerability</p> <p>Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot&lt;token&gt;/...`). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles.</p> <p>## Impact</p> <p>Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.14` - Fixed: `&gt;= 2026.2.15` (next release)</p> <p>## Mitigation</p> <p>- Upgrade to `openclaw &gt;= 2026.2.15` when released. - Rotate the Telegram bot token if it may have been exposed.</p> <p>## Fix Commit(s)</p> <p>- cf6990701b258bb9cc4ac7f6c7bdf05016e7f6e46</p> <p>Thanks @aether-ai-agent for reporting.</p> https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-27003 https://vulnerability.circl.lu/vuln/cve-2026-27003 <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot&lt;token&gt;/...`). Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Users should upgrade to version 2026.2.15 to obtain a fix and rotate the Telegram bot token if it may have been exposed.</p> <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot&lt;token&gt;/...`). Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Users should upgrade to version 2026.2.15 to obtain a fix and rotate the Telegram bot token if it may have been exposed.</p> https://vulnerability.circl.lu/vuln/cve-2026-27003