OpenClaw Resource Consumption Vulnerability in Telegram Audio Preflight Transcription

A resource consumption vulnerability has been identified in OpenClaw versions prior to 2026.3.31. This vulnerability allows unauthorized group senders to trigger audio preflight transcription processing in Telegram, exploiting insufficient allowlist enforcement. As a result, attackers can cause unnecessary resource or billing consumption by initiating audio preflight operations before the necessary authorization checks are applied.

Impact

Exploitation of this vulnerability leads to unauthorized resource or billing consumption by allowing group senders to trigger audio transcription processes without proper authorization.

Reproduction

In OpenClaw versions through 2026.3.28, unauthorized senders in Telegram groups can exploit this vulnerability by sending audio messages. The application will process these messages for transcription, causing resource consumption, before verifying if the sender is allowed to initiate such actions.

Remediation

Users can update to OpenClaw version 2026.3.31 or later, where this vulnerability has been patched.