Authorization Bypass in OpenClaw Affects Telegram Callback Handling

CVE-2026-35661

What is CVE-2026-35661?

An authorization bypass has been identified in OpenClaw affecting versions earlier than 2026.3.25, specifically in the handling of Telegram callback queries. This vulnerability enables remote attackers to exploit insufficient authorization checks associated with direct message (DM) interactions. By utilizing a weaker callback-only authorization within the Telegram framework, attackers can bypass standard DM pairing protocols thereby altering the session state inappropriately, which carries significant implications for user security and data integrity.

References