OpenClaw Main Rejects Unauthorized Telegram Command Media Before Download
Two merged Telegram fixes move account, topic and command authorization ahead of media ingestion so rejected group commands cannot trigger attachment downloads.
OpenClaw has merged two Telegram ingress fixes that move policy and command authorization ahead of attachment download. In affected group paths, media could be downloaded—or generate a warning—before OpenClaw decided that the message or control command was not authorized to run.
The follow-up explicitly covers attachments accompanying unauthorized control commands, including mentioned commands, mention-optional groups and disguised timestamp-prefixed command forms.
This is a sequencing flaw at a trust boundary. Rejection after download may stop agent execution, but it has already allowed an untrusted sender to consume network, provider and local media-processing resources.
The fixes are on main; confirm package inclusion separately.
What the two merges do
PR #117537 resolves the account-, conversation- and topic-aware Telegram group media policy before ingestion. It also brings album and captionless paths under the same policy decision rather than letting them diverge from normal mention handling.
PR #117821 closes the command-specific gap: if a control command is unauthorized, its attachment is rejected before any media download. The ordering should now be:
- identify provider account, chat and topic;
- normalize enough message text to classify the command safely;
- evaluate sender, mention and command authorization;
- evaluate the applicable group media policy; and only then
- fetch accepted media.
Interpretation: authorization must precede expensive or privacy-relevant ingestion, not merely precede tool execution.
Who should act
Prioritize a containing build if Telegram groups:
- permit media uploads from participants who are not command operators;
- use topic-specific policy;
- allow commands without an explicit bot mention;
- process albums or captionless attachments;
- run on metered bandwidth or constrained storage; or
- expose downloaded media to scanners, OCR, transcription or other downstream processors.
No public exploit procedure is needed to understand the risk. Any unauthorized media fetch expands resource consumption and the amount of untrusted content crossing the host boundary.
Safe acceptance test
Use a private staging group and tiny harmless files:
| Message | Expected result |
|---|---|
| Authorized ordinary media under allowed policy | Download occurs once and enters the intended session |
| Unauthorized control command with attachment | Command is rejected and no Telegram file fetch occurs |
| Mentioned but unauthorized command with attachment | Rejected before fetch |
| Mention-optional unauthorized command | Rejected before fetch |
| Captionless media under denied group policy | No fetch |
| Album under allowed policy | Accepted items follow one consistent policy and ordering |
| Same account, different topic policy | Each topic applies its own configured decision |
Observe the Telegram file-fetch call or equivalent media-ingress metric; a missing agent reply alone does not prove that no download happened.
Do not use oversized, malicious or sensitive samples. The test should prove ordering, not stress the provider or media stack.
Mitigation before upgrade
If a containing build is not yet available:
- restrict bot membership and group posting where practical;
- require explicit mentions for control paths;
- limit which senders can issue commands;
- constrain media size and downstream processing;
- monitor unexpected Telegram file-fetch volume; and
- avoid assuming an authorization rejection means zero media ingress.
These controls reduce exposure but do not repair the ordering defect.
Evidence and limits
The official merged-PR and commit records in the supplied repository packet establish the pre-download policy and authorization changes. PR #117821 is marked with sufficient proof; the earlier broad media-policy PR was still labelled as needing proof in the collected record. Direct GitHub page extraction returned HTTP 403, and OpenClaw Academy did not attach a Telegram bot to a live group. No claim is made that downloaded media bypassed command authorization after ingestion; the reported issue is that the fetch happened too early.
Bottom line
Telegram policy should decide whether OpenClaw may ingest an attachment before the host fetches it. Upgrade through staging, verify authorization and topic policy with file-fetch evidence, and keep resource controls in place even after the ordering fix lands in your build.
THE RECEIPTS
Claims should survive the click.
Primary links used for this article are listed openly. If the evidence changes, the verification date changes with it.THE OPERATOR BRIEF