Openclaw cli: OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check

In OpenClaw CLI's Telegram handler, inbound media in direct message mode was processed (downloaded and written to disk) prior to completing sender authorization checks. This flaw allowed unauthorized Telegram senders to cause media downloads and disk writes, including media groups, even when direct message access should have been denied. The fix, included in version 2026.2.24, reorders the processing flow to enforce direct message authorization before any media download or write operations occur and moves inbound channel activity tracking to after authorization.

Unauthorized Telegram senders can trigger inbound media download and disk write operations in OpenClaw CLI before authorization checks are completed. This could lead to unwanted disk usage or potential exposure to malicious media content despite access restrictions. There is no indication of remote code execution or data exfiltration from this vulnerability.

A patch is available in OpenClaw CLI version 2026.2.24. Users should upgrade to this version or later to ensure that Telegram direct message authorization is enforced before media download and write operations. No additional mitigation steps are indicated by the vendor advisory.