GHSA-w5ww-7chg-mxcq: OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram user able to invoke an affected callback could mark the callback as an authorized sender before applying commands.allowFrom.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw’s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.