OpenClaw: Telegram bot token exposure via logs (CVE-2026-27003)
OpenClaw versions up to 2026.2.14 logged Telegram bot tokens in error messages and stack traces without redaction, potentially exposing credentials in logs and crash reports. The vulnerability was patched in version 2026.2.15 with automatic redaction of sensitive tokens.
What happened
Telegram bot tokens could appear in error messages and stack traces when request URLs included the token, for example in https://api.telegram.org/bot<token>/... format.
OpenClaw versions up to 2026.2.14 logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles.
Reported impact
Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access.
Index analysis
The vulnerability was classified as CWE-522: Insufficiently Protected Credentials, relating to insecure transmission or storage of authentication credentials.
Governance controls
The fix involved implementing automatic redaction of Telegram bot tokens from error messages and uncaught stack traces in version 2026.2.15.
Users were advised to upgrade to version 2026.2.15 when released and rotate the Telegram bot token if it may have been exposed.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.