https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:56:48.340841+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-32982 BREW-openclaw-cli-CVE-2026-32982 — OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs 2026-10-06T11:56:48.343879+00:00

Affected: Homebrew: openclaw-cli

### Summary `openclaw` versions `<= 2026.3.12` could include raw Telegram bot tokens in media fetch error strings when inbound Telegram media downloads failed.

### Affected Packages / Versions - Package: `openclaw` (`npm`) - Affected versions: `<= 2026.3.12` - Fixed version: `2026.3.13`

### Details The vulnerable path was `fetchRemoteMedia()` in `src/media/fetch.ts`. In affected releases, fetch and HTTP error paths embedded the original Telegram file URL into `MediaFetchError` messages. For Telegram media, those URLs can include `/file/bot<TOKEN>/...`, so the resulting error strings could leak bot tokens into logs, console output, or any downstream error surface that rendered the exception text.

This issue is in scope under OpenClaw's trust model because the leaked secret is an OpenClaw-operated integration credential, not a user-supplied third-party secret.

### Fix `openclaw@2026.3.13` redacts sensitive media URLs before constructing fetch error messages. Current code routes the source URL and follow-on error paths through `redactMediaUrl()` / `redactSensitiveText()`, so Telegram bot tokens are no longer emitted in those error strings.

Regression coverage exists in `src/media/fetch.test.ts` (`redacts Telegram bot tokens from fetch failure messages` and `redacts Telegram bot tokens from HTTP error messages`).

### Fix Commit(s) - `7a53eb7ea8295b08be137e231c9a98c1a79b5cd5`

Thanks @space08 for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-329485 EUVD-2026-329485 2026-10-06T11:56:48.343940+00:00 EUVD-2026-329485 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32982 fkie_cve-2026-32982 2026-10-06T11:56:48.343957+00:00

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces.

 https://cve.radiocsirt.org/vuln/ghsa-xqg6-p6hx-f752 GHSA-xqg6-p6hx-f752 2026-10-06T11:56:48.343980+00:00

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0743 WID-SEC-W-2026-0743 — OpenClaw: Mehrere Schwachstellen 2026-10-06T11:56:48.343995+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um seine Privilegien zu erhöhen und um vertrauliche Informationen offenzulegen.