Incorrect authorization in OpenClaw - #VU128760
Published: May 1, 2026
Vulnerability identifier: #VU128760
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject unauthorized system events.
The vulnerability exists due to incorrect authorization in Telegram message_reaction handling when processing reaction notifications. A remote attacker can send reaction updates from an unauthorized sender to inject unauthorized system events.
Only instances with reaction notifications enabled are vulnerable.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.2.25