GitHub Advisoryadvisory · npm

GHSA-m6fx-m8hc-572m OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders

MEDIUM Published 2026-04-03 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-41331
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-408, CWE-770
Reviewed
2026-04-03

Affected packages

• npm openclaw: < 2026.3.31 → fixed in 2026.3.31

Description

Summary Telegram audio preflight transcription enables resource consumption by unauthorized senders Current Maintainer Triage • Status: narrow • Normalized severity: medium • Assessment: v2026.3.28 still lets unauthorized Telegram group senders trigger audio preflight before allowlist enforcement, but the real impact is resource or billing burn rather than direct data exposure or host compromise. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version: `2026.3.31` • Vulnerable version range: `= 2026.3.31` • First stable tag containing the fix: `v2026.3.31` Fix Commit(s) • `c4fa8635d03943ffe9e294d501089521dca635c5` — 2026-03-30T12:19:31+01:00 OpenClaw thanks @AntAISecurityLab for reporting.

Related

Alias · CVE (1)

  • CVE-2026-41331 OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized… vulnerability

Weakness · CWE (2)

  • CWE-408 Incorrect Behavior Order: Early Amplification weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References