GHSA-w5ww-7chg-mxcq: OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

commands.allowFrom limits which Telegram senders may run commands. For interactive callbacks, such as button presses, the code set the authorized-sender flag first and applied the allowlist afterwards. The allowlist therefore did not stop the callback. This is an incorrect authorization flaw (CWE-863 in the vendor's sister advisories).

The attacker needs a Telegram account that can reach the bot, in a chat where an affected callback is available. The CVSS vector lists no privileges and no user interaction. They press or forge the callback and the command runs as if the sender were allowed. The vector scores high integrity impact, with low confidentiality and availability impact. What actually runs depends on which commands your deployment exposes through callbacks. The advisory names neither the callbacks nor the code path.

The advisory keeps the trusted-operator model unchanged and says impact depends on configuration and on whether lower-trust users can reach the path. Bots added to public or large group chats are most exposed.

The npm package openclaw at 2026.5.5 and earlier, with the Telegram channel enabled and commands.allowFrom in use, in chats where untrusted users can invoke interactive callbacks.

npm ls openclaw

Use npm ls -g openclaw for a global install. Versions up to 2026.5.5 are affected.

Upgrade to [email protected], the first stable patched version:

npm install [email protected]

Until then, the advisory says to restrict Telegram command callbacks to trusted chats. It also advises narrow channel and tool allowlists, not sharing one Gateway between mutually untrusted users, and disabling the feature when you do not need it.

Review Telegram chat history and Gateway logs for callback queries from user IDs that are not in commands.allowFrom, and for commands that ran after them. Check for settings or state that changed after such callbacks. The advisory gives no log string. Remember that on affected versions the allowlist check came after the authorization mark, so an absent deny entry does not prove nothing ran.

Summary

Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram user able to invoke an affected callback could mark the callback as an authorized sender before applying commands.allowFrom.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could trigger command behavior outside the configured Telegram sender allowlist. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.6.

Mitigations

restrict Telegram command callbacks to trusted chats until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.