Openclaw cli: OpenClaw Telegram allowlist authorization accepted mutable usernames (CVE-2026-28480)

The OpenClaw CLI Telegram allowlist authorization mechanism previously matched on '@username', which are mutable and can be recycled, rather than on immutable numeric sender IDs. This allowed an attacker to impersonate a previously authorized user by acquiring their old username, leading to unauthorized access to the bot in allowlist mode. The issue affects npm packages 'openclaw' versions >=2026.1.29 and <2026.2.14 and 'clawdbot' versions <=2026.1.24-3. The fix enforces numeric sender ID checks only, rejects username allowlist entries, and adds tooling to convert legacy username entries to numeric IDs where possible.

Operators relying on Telegram allowlists for strict identity control risk unauthorized access if usernames change ownership. This can lead to unauthorized interaction with the bot, potentially compromising bot operations or data integrity. The impact is limited to identity spoofing via username recycling, with no direct denial of service or data confidentiality loss reported.

A patch is available and should be applied to upgrade to versions >=2026.2.14 where the fix is implemented. The fix rejects username-based allowlist entries and requires numeric Telegram sender IDs. Operators should run 'openclaw doctor --fix' to convert legacy username allowlist entries to numeric IDs, which requires a Telegram bot token. The vendor added a security audit warning to flag legacy configurations. No further action is required once patched.