CVE-2026-32982

HIGH

OpenClaw < 2026.3.13 - Telegram Bot Token Exposure in Media Fetch Error Logs

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-xwcj-hwhf-h378)
https://github.com/openclaw/openclaw/security/advisories/GHSA-xwcj-hwhf-h378
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.13 - Telegram Bot Token Exposure in Media Fetch Error Logs
https://www.vulncheck.com/advisories/openclaw-telegram-bot-token-exposure-in-media-fetch-error-logs

Scores

CVSS v3 7.5
EPSS 0.0042
EPSS Percentile 33.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-532
Status published
Products (3)
OpenClaw/OpenClaw < 2026.3.13
openclaw/openclaw < 2026.3.13
OpenClaw/OpenClaw 2026.3.13
Published Mar 31, 2026
Tracked Since Mar 31, 2026