OpenClaw patches unauthenticated Telegram webhook resource-exhaustion flaw (CVE-2026-32980)

Photo by Ales Nesetril on Unsplash

What happened

OpenClaw disclosed and patched CVE-2026-32980 in openclaw@2026.3.13.

According to the vendor advisory, versions up to 2026.3.12 processed Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header. That sequence let unauthenticated requests consume memory, socket time, and JSON parsing work before rejection.

Why this matters

If your OpenClaw instance exposes a Telegram webhook endpoint, this bug can be used as a low-friction denial-of-service path. Attackers do not need valid webhook secrets to force pre-auth workload, which can degrade bot availability or increase infrastructure load.

For teams running automation on small VPS or home-lab hardware, this can cause noticeable instability under request floods.

How to check if you’re affected

You are likely affected if you run OpenClaw with Telegram webhooks on version 2026.3.12 or older.

1. Check your OpenClaw version

   • Run your normal version command and verify whether you are on 2026.3.13 or later.

2. Confirm Telegram webhook exposure

   • Verify whether Telegram webhook mode is enabled and reachable from the internet.

3. Review logs around webhook endpoints

   • Look for spikes of unauthorized or malformed POST traffic to the Telegram webhook path.

4. Validate patched behavior

   • After upgrading, confirm unauthorized webhook requests are rejected quickly (401) before heavy body processing.

5. If you cannot upgrade immediately

   • Restrict webhook ingress by IP/network controls and add rate limiting at the edge until patching is complete.

Immediate defensive actions

• Upgrade to openclaw@2026.3.13 or newer.
• Put rate limiting/WAF protections in front of webhook endpoints.
• Monitor service memory and request error patterns for attempted abuse.
• Review other webhook handlers to ensure authentication happens before expensive parsing.

Sources

• https://github.com/openclaw/openclaw/security/advisories/GHSA-jq3f-vjww-8rq7 (primary source)
• https://github.com/openclaw/openclaw/commit/7e49e98f79073b11134beac27fdff547ba5a4a02 (primary source)
• https://nvd.nist.gov/vuln/detail/CVE-2026-32980

Bottom line

If you use OpenClaw with Telegram webhooks, treat this as a priority availability hardening update: upgrade to 2026.3.13+ and ensure pre-auth request handling is tightly constrained.