CVE-2026-32982: OpenClaw Telegram bot token leaked

CISO Take

OpenClaw embeds Telegram bot tokens in cleartext within MediaFetchError strings whenever the fetchRemoteMedia function fails — tokens that surface both in server logs and in live error responses visible to external callers. A Telegram bot token is a master credential: whoever captures it gains full API control over the bot, can read every user conversation, send fraudulent messages to all subscribers, and pivot into any backend system the bot is connected to. The vulnerability is network-reachable with zero privileges and no user interaction required (CVSS 7.5), and sits in the top 67th EPSS percentile for exploitation likelihood. Patch immediately to OpenClaw 2026.3.13 and rotate all Telegram bot tokens that ran on any prior version; audit existing logs for exposure by grepping for 'api.telegram.org/bot' patterns.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High risk for any OpenClaw deployment that uses Telegram as an agent communication channel. The CVSS 7.5 reflects a remotely exploitable credential disclosure with no authentication barrier — triggering a failed media fetch and reading the error output is a trivial, repeatable operation requiring no specialized skills. The actual blast radius extends well beyond confidentiality: a stolen bot token enables full account takeover, conversation interception, impersonation of the agent to all users, and lateral movement into integrated enterprise systems. With 396 prior CVEs in the same package and 4 downstream dependents, this package carries significant accumulated security debt that amplifies organizational exposure.

How does the attack unfold?

Trigger Media Failure

Adversary sends a request to the OpenClaw agent containing a malformed, unreachable, or attacker-controlled Telegram media URL, causing fetchRemoteMedia to raise a MediaFetchError.

AML.T0049

Token Exposure

MediaFetchError embeds the original Telegram file URL (containing the bot token in plaintext as a path component) in the exception string, which is written to server logs and optionally propagated to external error surfaces.

AML.T0055

Credential Harvesting

Attacker reads the bot token from the HTTP error response directly, or recovers it from log aggregation systems, SIEM exports, or misconfigured log forwarding pipelines.

AML.T0106

Bot Account Takeover

Using the harvested token against the Telegram Bot API, the attacker gains full control of the agent bot — reading all user conversations, sending fraudulent messages to every subscriber, and invoking any backend integrations the bot has access to.

AML.T0012

Trigger Media Failure

Adversary sends a request to the OpenClaw agent containing a malformed, unreachable, or attacker-controlled Telegram media URL, causing fetchRemoteMedia to raise a MediaFetchError.

AML.T0049

Token Exposure

MediaFetchError embeds the original Telegram file URL (containing the bot token in plaintext as a path component) in the exception string, which is written to server logs and optionally propagated to external error surfaces.

AML.T0055

Credential Harvesting

Attacker reads the bot token from the HTTP error response directly, or recovers it from log aggregation systems, SIEM exports, or misconfigured log forwarding pipelines.

AML.T0106

Bot Account Takeover

Using the harvested token against the Telegram Bot API, the attacker gains full control of the agent bot — reading all user conversations, sending fraudulent messages to every subscriber, and invoking any backend integrations the bot has access to.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Upgrade OpenClaw to 2026.3.13 immediately (patch commit 7a53eb7ea8295b08be137e231c9a98c1a79b5cd5).
Rotate all Telegram bot tokens for any bot that ran a pre-patch version — treat all prior tokens as compromised if errors were ever logged or surfaced externally.
Audit existing log repositories for exposed tokens by searching for the pattern 'api.telegram.org/bot' across log aggregation systems, SIEMs, and archived error outputs.
Implement log scrubbing middleware to redact Telegram API URL patterns before writing to any log sink.
Review error-handling layers to ensure MediaFetchError and similar exception types strip or mask URL parameters before propagating to API responses or UI error surfaces.

How is it classified?

Data Leakage Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.2 - Information security in AI system lifecycle

NIST AI RMF

MANAGE-2.2 - Mechanisms to sustain AI risk management

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-32982?

OpenClaw embeds Telegram bot tokens in cleartext within MediaFetchError strings whenever the fetchRemoteMedia function fails — tokens that surface both in server logs and in live error responses visible to external callers. A Telegram bot token is a master credential: whoever captures it gains full API control over the bot, can read every user conversation, send fraudulent messages to all subscribers, and pivot into any backend system the bot is connected to. The vulnerability is network-reachable with zero privileges and no user interaction required (CVSS 7.5), and sits in the top 67th EPSS percentile for exploitation likelihood. Patch immediately to OpenClaw 2026.3.13 and rotate all Telegram bot tokens that ran on any prior version; audit existing logs for exposure by grepping for 'api.telegram.org/bot' patterns.

Is CVE-2026-32982 actively exploited?

No confirmed active exploitation of CVE-2026-32982 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32982?

1. Upgrade OpenClaw to 2026.3.13 immediately (patch commit 7a53eb7ea8295b08be137e231c9a98c1a79b5cd5). 2. Rotate all Telegram bot tokens for any bot that ran a pre-patch version — treat all prior tokens as compromised if errors were ever logged or surfaced externally. 3. Audit existing log repositories for exposed tokens by searching for the pattern 'api.telegram.org/bot' across log aggregation systems, SIEMs, and archived error outputs. 4. Implement log scrubbing middleware to redact Telegram API URL patterns before writing to any log sink. 5. Review error-handling layers to ensure MediaFetchError and similar exception types strip or mask URL parameters before propagating to API responses or UI error surfaces.

What systems are affected by CVE-2026-32982?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Telegram-integrated AI agents, Agent communication channels, AI assistant deployments with messaging platform backends.

What is the CVSS score for CVE-2026-32982?

CVE-2026-32982 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksTelegram-integrated AI agentsAgent communication channelsAI assistant deployments with messaging platform backends

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.2

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces.

Exploitation Scenario

An adversary targeting an OpenClaw-powered AI agent with Telegram integration sends a crafted request that causes a media download failure — for example, by supplying a URL to an unreachable or attacker-controlled media resource. OpenClaw's fetchRemoteMedia constructs a MediaFetchError that embeds the original Telegram file URL in the format 'https://api.telegram.org/bot<TOKEN>/getFile?...' in the exception string. If the agent surfaces errors via HTTP response bodies or UI messages, the attacker reads the token directly from the network response with no further access required. In environments where errors are only logged, the attacker may recover the token via misconfigured log forwarding, a compromised SIEM export, or log aggregation services with overly permissive access. With the token extracted, the attacker uses the Telegram Bot API to enumerate all conversation history, exfiltrate user messages, send fraudulent instructions to all bot subscribers impersonating the agent, and invoke any backend integrations the bot has access to.

Weaknesses (CWE)

CWE-532 Insertion of Sensitive Information into Log File

CWE-532 — Insertion of Sensitive Information into Log File: The product writes sensitive information to a log file.

[Architecture and Design, Implementation] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
[Distribution] Remove debug log files before deploying the application into production.

Source: MITRE CWE corpus.