GHSA-xwcj-hwhf-h378: OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs

March 16, 2026

openclaw versions <= 2026.3.12 could include raw Telegram bot tokens in media fetch error strings when inbound Telegram media downloads failed.

References

github.com/advisories/GHSA-xwcj-hwhf-h378
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/7a53eb7ea8295b08be137e231c9a98c1a79b5cd5
github.com/openclaw/openclaw/security/advisories/GHSA-xwcj-hwhf-h378

Code Behaviors & Features

Detect and mitigate GHSA-xwcj-hwhf-h378 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →