漏洞关键信息 漏洞标题: - Telegram webhook requests may be accepted without verifying secret token when webhookSecret is missing 漏洞严重性: - High (7.5 / 10) 受影响的版本: - =2026.2.1 漏洞描述: - In Telegram webhook mode, if is not set, OpenClaw may accept webhook HTTP requests without verifying Telegram's secret token header. This can allow forged Telegram updates in vulnerable deployments. 影响: - If an attacker can reach the webhook endpoint, they may be able to send forged updates that are processed as if they came from Telegram, potentially leading to unintended bot actions. 缓解措施: - Set a strong and ensure your reverse proxy forwards the header unchanged. - Restrict network access to the webhook endpoint. 修复提交: - ca92597 (fixes webhookSecret validation) - Additional defense-in-depth fixes: 5643a93, 3cbcbaf, 633fe8b CVE ID: - CVE-2026-25474 弱点: - CWE-345