CVE-2026-25474

Name: CVE-2026-25474
Creator: NVD / NIST
Published: 2026-02-19T07:17:45.847+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 0.20%

Last modified Jun 17, 2026

CVE-2026-25474 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In deployments where the webhook endpoint is reachable by an attacker, this can allow forged Telegram updates (for example spoofing message.from.id). If an attacker can reach the webhook endpoint, they may be able to send forged updates that are processed as if they came from Telegram. Depending on enabled commands/tools and configuration, this could lead to unintended bot actions. Note: Telegram webhook mode is not enabled by default. It is enabled only when `channels.telegram.webhookUrl` is configured. This issue has been fixed in version 2026.2.1.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

0.20%

9.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-345

Affected Software

Vendor	Product	Versions
Openclaw	Openclaw	< 2026.2.1

References

https://github.com/openclaw/openclaw/commit/3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930Patch
https://github.com/openclaw/openclaw/commit/5643a934799dc523ec2ef18c007e1aa2c386b670Patch
https://github.com/openclaw/openclaw/commit/633fe8b9c17f02fcc68ecdb5ec212a5ace932f09Patch
https://github.com/openclaw/openclaw/commit/ca92597e1f9593236ad86810b66633144b69314dPatch
https://github.com/openclaw/openclaw/releases/tag/v2026.2.1Product, Release Notes
https://github.com/openclaw/openclaw/security/advisories/GHSA-mp5h-m6qj-6292Exploit, Mailing List, Patch, Vendor Advisory

Timeline

Published: Feb 19, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-25474?

How severe is CVE-2026-25474?

CVE-2026-25474 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.

How do I fix CVE-2026-25474?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-25474?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST