Is CVE-2026-25474 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-25474, but active exploitation has not been confirmed.

Can CVE-2026-25474 be exploited remotely?

Yes. CVE-2026-25474 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-25474?

CVE-2026-25474 has a CVSS score of 7.5 (HIGH) and an EPSS exploitation probability of 0.02%.

HOME VULNERABILITIESCVE-2026-25474

HIGHPOC

CVE-2026-25474

CWE-345Published: February 19, 2026· Updated: Feb 19, 2026

7.5

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:3.1th

Official Description

OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In deployments where the webhook endpoint is reachable by an attacker, this can allow forged Telegram updates (for example spoofing message.from.id). If an attacker can reach the webhook endpoint, they may be able to send forged updates that are processed as if they came from Telegram. Depending on enabled commands/tools and configuration, this could lead to unintended bot actions. Note: Telegram webhook mode is not enabled by default. It is enabled only when `channels.telegram.webhookUrl` is configured. This issue has been fixed in version 2026.2.1.

NVD Source

Technical Analysis

CVE-2026-25474 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.

A proof-of-concept (PoC) exploit exists for CVE-2026-25474. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.