Vulnerability Description
OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.13 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/7a53eb7ea8295b08be137e231c9a98c1a79bPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-xwcj-hwhf-h378Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-telegram-bot-token-exposure-in-medThird Party Advisory
FAQ
What is CVE-2026-32982?
CVE-2026-32982 is a vulnerability with a CVSS score of 7.5 (HIGH). OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original ...
How severe is CVE-2026-32982?
CVE-2026-32982 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32982?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.