OpenClaw Information Disclosure via Telegram Bot Token Exposure

hello@craftedsignal.io — Tue, 31 Mar 2026 12:16:29 +0000

OpenClaw versions prior to 2026.3.13 are susceptible to an information disclosure vulnerability (CVE-2026-32982). The vulnerability resides within the fetchRemoteMedia function. When OpenClaw attempts to download media from Telegram and the download fails, the application generates an error message. Critically, the original Telegram file URL, which contains the Telegram bot token, is included in the MediaFetchError string. This error message is then logged and potentially displayed on error surfaces, leading to the exposure of sensitive bot tokens. This vulnerability was reported on March 31, 2026, and poses a risk to OpenClaw users who leverage Telegram bots, as compromised tokens could lead to unauthorized access and control of the bots.

Attack Chain

An attacker identifies an OpenClaw instance running a version prior to 2026.3.13.
The attacker crafts a malicious request that triggers the fetchRemoteMedia function to download a non-existent or inaccessible media file from Telegram.
The fetchRemoteMedia function attempts to download the media from the provided Telegram URL, which includes the bot token.
The download fails due to the file not being found or being inaccessible.
The fetchRemoteMedia function generates a MediaFetchError string that includes the original Telegram URL, containing the bot token.
This error message, including the Telegram bot token, is written to application logs or displayed on error surfaces (e.g., web interface).
An attacker gains access to the logs or error surfaces and extracts the Telegram bot token.
The attacker uses the compromised Telegram bot token to perform unauthorized actions via the Telegram bot, potentially leading to data theft, service disruption, or other malicious activities.

Impact

Successful exploitation of CVE-2026-32982 can lead to the exposure of Telegram bot tokens used by OpenClaw. Compromised bot tokens allow attackers to control the associated Telegram bots, potentially leading to unauthorized data access, message manipulation, or other malicious activities. The severity of the impact depends on the permissions and capabilities of the compromised bot. While the specific number of affected OpenClaw instances is unknown, any organization using OpenClaw with Telegram bot integration is potentially at risk.

Recommendation

Upgrade OpenClaw to version 2026.3.13 or later to remediate CVE-2026-32982.
Review existing OpenClaw logs for any instances of MediaFetchError strings containing Telegram bot tokens.
Implement stricter access controls on OpenClaw logs to prevent unauthorized access to sensitive information.
Deploy the Sigma rule Detect Telegram Bot Token Leak in Logs to identify potential token exposure in log files.

Suspicious DNS Queries to Telegram API by Non-Telegram Processes

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

This alert identifies systems querying the Telegram API domain (api.telegram.org) using processes other than the legitimate Telegram application. Threat actors frequently leverage Telegram bots for C2, due to their ease of use, encryption, and widespread availability. Malware can use these bots to receive commands, exfiltrate data, or perform other malicious activities. Detecting DNS queries for Telegram’s API from unexpected processes can uncover compromised systems or unauthorized use of Telegram for covert communication. The detection focuses on non-standard Telegram clients resolving the api.telegram.org domain to filter out legitimate Telegram application traffic and focus on suspicious processes.

Attack Chain

A user inadvertently downloads and executes a malicious payload (e.g., via phishing or drive-by download).
The malware establishes persistence on the system (e.g., via registry keys or scheduled tasks).
The malware initiates a DNS query to resolve api.telegram.org to identify the Telegram API server IP address.
The malware establishes a communication channel with a Telegram bot controlled by the attacker using the resolved IP address.
The attacker sends commands to the bot, which are relayed to the compromised system.
The malware executes the received commands, potentially including data exfiltration or further malicious actions.
The malware exfiltrates sensitive data to the attacker via the Telegram bot.
The attacker maintains persistent access and control over the compromised system via the Telegram bot.

Impact

Compromised systems can be remotely controlled by attackers, leading to data theft, system disruption, or further propagation of malware within the network. The use of Telegram bots enables covert communication, making it difficult to detect malicious activity using traditional methods. Multiple threat actors employ Telegram-based C2, including those associated with information stealers, keyloggers, and crypto-mining malware. A successful attack can lead to significant data breaches and financial losses.

Recommendation

Deploy the Sigma rule Detect Suspicious Telegram DNS Queries to your SIEM to identify processes making DNS queries to the Telegram API (api.telegram.org) other than the legitimate Telegram application.
Investigate any alerts generated by the Sigma rule by examining the process execution history, network connections, and related system activity.
Block the domain api.telegram.org at the DNS resolver or firewall to prevent compromised systems from communicating with Telegram bots, unless legitimate business use requires it.
Enable Sysmon Event ID 22 (DNS Query) logging to capture DNS query events on endpoints.
Update Sysmon to at least version 6.0.4 to ensure comprehensive DNS event logging.

Telegram — CraftedSignal Threat Feed

OpenClaw Information Disclosure via Telegram Bot Token Exposure

Attack Chain

Impact

Recommendation

Suspicious DNS Queries to Telegram API by Non-Telegram Processes

Attack Chain

Impact

Recommendation