Openclaw cli: OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders (CVE-2026-41331)
Description
A vulnerability in the openclaw-cli package allows unauthorized Telegram group senders to trigger audio preflight transcription, causing resource consumption. The issue affects versions from 2026.1.29 up to but not including 2026.3.31. The impact is limited to resource or billing consumption without direct data exposure or host compromise. A patch is available in version 2026.3.31.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The openclaw-cli package contains a vulnerability (CVE-2026-41331) where unauthorized senders in Telegram groups can trigger audio preflight transcription before allowlist enforcement. This leads to resource consumption or billing impact but does not expose data or compromise the host. The vulnerability affects versions >=2026.1.29 and <2026.3.31. The issue was fixed in version 2026.3.31 with commit c4fa8635d03943ffe9e294d501089521dca635c5.
Potential Impact
Unauthorized Telegram group senders can cause resource consumption or billing charges by triggering audio preflight transcription. There is no direct impact on data confidentiality or system integrity, and no host compromise is involved.
Mitigation Recommendations
Upgrade openclaw-cli to version 2026.3.31 or later where the vulnerability is patched. Versions >=2026.3.31 contain the fix. No additional mitigation is required as the patch addresses the issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-41331
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245a612601ec6a31661a7
Added to database: 10/04/2026, 12:25:10 UTC
Last enriched: 10/04/2026, 12:51:00 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.