GHSA-chf7-jq6g-qrwv OpenClaw: Telegram bot token exposure via logs

• npm openclaw: < 2026.2.15 → fixed in 2026.2.15

Vulnerability Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot/...`). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Impact Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Affected Packages / Versions • Package: `openclaw` (npm) • Affected: `= 2026.2.15` (next release) Mitigation • Upgrade to `openclaw >= 2026.2.15` when released. • Rotate the Telegram bot token if it may have been exposed. Fix Commit(s) • cf6990701b258bb9cc4ac7f6c7bdf05016e7f6e46 Thanks @aether-ai-agent for reporting.