NVD HIGH: CVE-2026-32980 — OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies befo...

Sunday, March 29, 2026 at 01:17 PM UTC·Source: NIST NVD

Updated: Friday, April 3, 2026 at 09:52 PM UTC

Executive Summary

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-32980

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Mar 29, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Inconsistent Privacy Labels Don't Tell Users What They Are Getting

Data privacy labels are a great idea for mobile apps, but the current versions just aren't good enough.

3h agoDark Reading

MEDIUMVulnerability

LinkedIn secretely scans for 6,000+ Chrome extensions, collects data

A new report dubbed "BrowserGate" warns that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to scan visitors' browsers for installed extensions and collect device data. [...]

4h agoBleepingComputer

MEDIUMVulnerability

FCC proposes $4.5 million fine for voice service provider hosting ‘suspicious’ foreign call traffic

Voxbeam’s actions allegedly led to “financial impersonation robocalls” that were made to American consumers “ using “non-compliant and long dormant accounts,” the FCC said.

4h agoThe Record