CVE-2026-27003: OpenClaw: Telegram bot token exposure via logs

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-20 · updated 2026-06-17
Weakness: CWE-522

Description

OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot<token>/...`). Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Users should upgrade to version 2026.2.15 to obtain a fix and rotate the Telegram bot token if it may have been exposed.

Affected products

OpenClaw: before 2026.2.15 — fixed in 2026.2.15

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-27003 or the next vulnerability affects your stack