A critical information disclosure vulnerability in OpenClaw allows for the potential exposure of sensitive Telegram bot tokens via application logs, posing a significant risk of unauthorized account access.

The application fails to properly sanitize error messages within the fetchRemoteMedia function, leading to the inclusion of sensitive Telegram bot tokens in log files and error surfaces when a download fails. This vulnerability is exploitable by an unauthenticated attacker who can trigger or access these error logs.

The compromise of Telegram bot tokens grants unauthorized parties the ability to impersonate the bot, access private conversations, or manipulate integrated services. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to data confidentiality and operational integrity, as the leaked credentials can lead to persistent unauthorized access to the bot account.

Immediate Action: Upgrade the OpenClaw package to version 2026.3.13 or later to apply the necessary sanitization logic in the media fetch process.

Proactive Monitoring: Review existing application logs and error reporting systems for any occurrences of Telegram tokens or sensitive URLs to determine if credentials have already been exposed.

Compensating Controls: If an immediate upgrade is not feasible, restrict access to application logs to authorized personnel only and rotate any Telegram bot tokens that may have appeared in error logs.

Public Exploit Available: No (exploit_available unknown).

Given the sensitivity of the exposed credentials, this vulnerability carries a high risk of downstream compromise. Security teams should prioritize patching to version 2026.3.13 immediately and perform a thorough audit of log repositories to identify potential past token exposure. Failure to remediate this issue could result in the total compromise of all associated Telegram bot functionality.