Detections
Analytics

SCA: security update for openclaw (GHSA-mp5h-m6qj-6292)

high Tenable Self-Hosted Container Security Plugin ID 437790

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret
 is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying
 Telegram’s secret token header. In deployments where the webhook endpoint is reachable by an attacker,
 this can allow forged Telegram updates (for example spoofing message.from.id). If an attacker can reach
 the webhook endpoint, they may be able to send forged updates that are processed as if they came from
 Telegram. Depending on enabled commands/tools and configuration, this could lead to unintended bot
 actions. Note: Telegram webhook mode is not enabled by default. It is enabled only when
 `channels.telegram.webhookUrl` is configured. This issue has been fixed in version 2026.2.1.
 (CVE-2026-25474)

See Also

https://github.com/advisories/GHSA-mp5h-m6qj-6292

Plugin Details

Severity: High

ID: 437790

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 2/18/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-25474

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/17/2026

Vulnerability Publication Date: 2/17/2026

Reference Information

CVE: CVE-2026-25474

cwe: CWE-345