CVE-2026-28480Disclosure(openclaw / openclaw)

LOWCVSS 6.9 · MEDIUM

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Prioritize remediation for openclaw openclaw systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with bots as unauthorized senders.

openclaw CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Weakness type (CWE)

CWE-290

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

Active exploitation appears in 2 classified signals
5 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Technical details provided in 5 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-06); latest day: 2
5 total mentions across 3 days

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline5 mentions / 3d

Signal classification2 categories

Disclosure

360.0%

Active Exploitation

240.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-05	1	Disclosure1
2026-03-06	2	Disclosure2
2026-06-06	2	Active Exploitation2

Full discourse5 posts

ThreadLinqs@threadlinqs124d
Active Exploitation
THREAT INTEL: OpenClaw allowlist bypass (CVE-2026-28480, CVSS 9.4) hijacks trusted AI agents across 6 channels. 9 detections. https://intel.threadlinqs.com/threat/TL-2026-0687 #ThreatIntel #InfoSec https://t.co/U6SZC9soSY
Post summary
OpenClaw allowlist bypass CVE-2026-28480 has been detected 9 times in the wild, indicating active exploitation, but no PoC, exploit code, or patch information is provided.
2001081
57 followersView on X
ThreadLinqs@threadlinqs124d
Active Exploitation
NEW THREAT INTEL: OpenClaw allowlist bypass hijacks trusted AI agents (CVE-2026-28480, CVSS 9.4). 9 detections, 13 IOCs. https://intel.threadlinqs.com/threat/TL-2026-0687 #ThreatIntel #AISecurity https://t.co/1SlaLc8pno
Post summary
The threat intel report confirms that CVE-2026-28480, an allowlist bypass that hijacks AI agents, is actively exploited in the wild, evidenced by nine detections and 13 indicators of compromise.
0000054
57 followersView on X
Infoflowcloud@infoflowcloud215d
Disclosure
🚨*CVE* CVE-2026-28480 OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable nu… https://www.cve.org/CVERecord?id=CVE-2026-28480 ----- Traducción: CVE-2026-28480 Las… http://infoflow.cloud`
Post summary
The tweet discloses CVE‑2026‑28480 for OpenClaw, describing an authorization bypass via mutable usernames in allowlist matching, but provides no patch, exploit, or PoC information.
0000049
56 followersView on X
CVE@CVEnew215d
Disclosure
CVE-2026-28480 OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable nu… https://www.cve.org/CVERecord?id=CVE-2026-28480
Post summary
The text discloses that OpenClaw versions before 2026.2.14 contain an authorization bypass flaw related to mutable usernames in Telegram allowlist matching; no PoC, exploit, or patch is mentioned.
00000295
56.6K followersView on X
CVEFind.com@CveFindCom216d
Disclosure
[CVE-2026-28480: CRITICAL] Beware of OpenClaw versions pre-2026.2.14! An authorization bypass vulnerability allows attackers to spoof identity and interact with bots using recycled usernames. Cybersecurity a...#cve,CVE-2026-28480,#cybersecurity https://cvefind.com/CVE-2026-28480
Post summary
The tweet announces a critical authorization bypass in OpenClaw pre‑2026.2.14 that enables attackers to spoof identities and interact with bots, but no PoC, exploit code, active exploitation, patch, or debunking is mentioned.
0000063
596 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-28480

ThreadLinqs[verified]@threadlinqsActive Exploitation

OpenClaw allowlist bypass CVE-2026-28480 has been detected 9 times in the wild, indicating active exploitation, but no PoC, exploit code, or patch information is provided.

ThreadLinqs[verified]@threadlinqsActive Exploitation

The threat intel report confirms that CVE-2026-28480, an allowlist bypass that hijacks AI agents, is actively exploited in the wild, evidenced by nine detections and 13 indicators of compromise.

Infoflowcloud@infoflowcloudDisclosure

The tweet discloses CVE‑2026‑28480 for OpenClaw, describing an authorization bypass via mutable usernames in allowlist matching, but provides no patch, exploit, or PoC information.

CVE@CVEnewDisclosure

The text discloses that OpenClaw versions before 2026.2.14 contain an authorization bypass flaw related to mutable usernames in Telegram allowlist matching; no PoC, exploit, or patch is mentioned.

CVEFind.com@CveFindComDisclosure

The tweet announces a critical authorization bypass in OpenClaw pre‑2026.2.14 that enables attackers to spoof identities and interact with bots, but no PoC, exploit code, active exploitation, patch, or debunking is mentioned.