What is CVE-2026-32982?

CVE-2026-32982 is a high-severity vulnerability in Openclaw, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.5/10. Published 2026-03-31.

How severe is CVE-2026-32982?

High severity. CVSS v3 base score is 7.5 out of 10.

Information disclosure in Openclaw

CVE-2026-32982

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces.

Published 2026-03-31 · last modified 2026-07-25.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.005 (40.8th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 40.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001

Affected products

Openclaw — versions 0, 2026.3.13

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

github.com/openclaw/openclaw/security/advisories/GHSA-xwcj-hwhf-h378 (vendor-advisory, Vendor Advisory, third-party-advisory)
github.com/openclaw/openclaw/commit/7a53eb7ea8295b08be137e231c9a98c1a79b5cd5 (Patch, patch)
www.vulncheck.com/advisories/openclaw-telegram-bot-token-exposure-in-media-fetc… (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-32982?: CVE-2026-32982 is a high-severity vulnerability in Openclaw, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.5/10. Published 2026-03-31.
How severe is CVE-2026-32982?: High severity. CVSS v3 base score is 7.5 out of 10.