Teknium
16accd44bd
fix(telegram): require TELEGRAM_WEBHOOK_SECRET in webhook mode ( #13527 )
...
When TELEGRAM_WEBHOOK_URL was set but TELEGRAM_WEBHOOK_SECRET was not,
python-telegram-bot received secret_token=None and the webhook endpoint
accepted any HTTP POST. Anyone who could reach the listener could inject
forged updates — spoofed user IDs, spoofed chat IDs, attacker-controlled
message text — and trigger handlers as if Telegram delivered them.
The fix refuses to start the adapter in webhook mode without the secret.
Polling mode (default, no webhook URL) is unaffected — polling is
authenticated by the bot token directly.
BREAKING CHANGE for webhook-mode deployments that never set
TELEGRAM_WEBHOOK_SECRET. The error message explains remediation:
export TELEGRAM_WEBHOOK_SECRET="$(openssl rand -hex 32)"
and instructs registering it with Telegram via setWebhook's secret_token
parameter. Release notes must call this out.
Reported in GHSA-3vpc-7q5r-276h by @bupt-Yy-young. Hardening — not CVE
per SECURITY.md §3 "Public Exposure: Deploying the gateway to the
public internet without external authentication or network protection"
covers the historical default, but shipping a fail-open webhook as the
default was the wrong choice and the guard aligns us with the SECURITY.md
threat model.
2026-04-21 06:23:09 -07:00
..
2026-02-26 03:20:08 +03:00
2026-04-16 06:49:36 -07:00
2026-04-20 05:15:54 -07:00
2026-04-17 06:36:34 -07:00
2026-03-29 21:29:13 -07:00
2026-04-10 16:51:44 -07:00
2026-04-21 00:50:58 -07:00
2026-04-20 04:16:13 -07:00
2026-04-12 18:03:16 -07:00
2026-04-07 03:28:44 -07:00
2026-04-20 22:13:07 -07:00
2026-04-11 02:03:20 -07:00
2026-04-01 12:05:02 -07:00
2026-04-14 16:56:49 -07:00
2026-04-16 06:31:23 -07:00
2026-04-15 15:09:23 -07:00
2026-04-10 03:52:00 -07:00
2026-04-17 01:05:09 -07:00
2026-04-14 22:07:28 -07:00
2026-04-19 01:48:42 -07:00
2026-04-17 20:25:48 -07:00
2026-04-12 03:03:07 -07:00
2026-04-18 18:53:22 -07:00
2026-04-16 06:31:23 -07:00
2026-04-11 19:23:29 -07:00
2026-04-16 06:48:33 -07:00
2026-04-17 06:26:18 -07:00
2026-04-10 03:44:43 -07:00
2026-04-17 19:26:53 -07:00
2026-04-17 04:08:42 -07:00
2026-04-17 04:59:03 -07:00
2026-04-17 05:48:26 -07:00
2026-03-09 02:20:57 -07:00
2026-04-09 23:25:27 -07:00
2026-04-19 18:12:55 -07:00
2026-04-10 05:19:26 -07:00
2026-04-17 04:08:42 -07:00
2026-04-09 02:26:33 -07:00
2026-04-17 06:46:52 -07:00
2026-03-14 09:32:05 -07:00
2026-03-13 08:52:54 -07:00
2026-03-14 14:27:21 +03:00
2026-04-19 11:08:10 -07:00
2026-04-10 03:52:00 -07:00
2026-04-17 04:17:56 -07:00
2026-04-17 20:25:48 -07:00
2026-04-17 06:46:52 -07:00
2026-03-23 06:50:09 -07:00
2026-04-11 13:59:52 -07:00
2026-04-14 10:52:23 -07:00
2026-04-20 00:57:53 -07:00
2026-04-03 13:16:26 -07:00
2026-04-16 05:53:18 -07:00
2026-04-17 01:05:09 -07:00
2026-03-17 01:47:34 -07:00
2026-04-10 21:16:56 -07:00
2026-04-19 18:12:55 -07:00
2026-04-14 14:22:11 -07:00
2026-04-17 19:04:11 -07:00
2026-04-17 19:04:11 -07:00
2026-04-12 13:05:56 -07:00
2026-04-20 02:04:57 -07:00
2026-04-16 06:31:23 -07:00
2026-04-08 20:01:06 -07:00
2026-04-10 21:18:34 -07:00
2026-04-17 01:05:09 -07:00
2026-03-29 20:05:59 -07:00
2026-04-15 17:54:16 -07:00
2026-04-21 01:33:10 -07:00
2026-03-15 03:50:45 -07:00
2026-04-17 04:03:02 +05:30
2026-04-16 20:43:41 -07:00
2026-04-17 01:05:09 -07:00
2026-04-17 01:05:09 -07:00
2026-04-10 05:04:28 -07:00
2026-02-28 03:38:27 -05:00
2026-04-15 13:35:40 -07:00
2026-03-11 09:15:34 +01:00
2026-04-10 03:07:00 -07:00
2026-04-10 02:58:42 -07:00
2026-03-05 18:39:37 -08:00
2026-04-18 19:32:26 -07:00
2026-04-19 03:03:57 -07:00
2026-04-10 03:44:43 -07:00
2026-03-14 21:28:51 -07:00
2026-04-12 19:06:20 -07:00
2026-04-07 09:58:45 -07:00
2026-04-21 05:52:46 -07:00
2026-04-17 15:31:14 -07:00
2026-04-11 14:43:53 -07:00
2026-04-08 03:36:44 -07:00
2026-04-20 05:15:54 -07:00
2026-04-12 22:32:19 -07:00
2026-04-17 21:17:33 -07:00
2026-04-18 17:40:34 -07:00
2026-04-11 03:11:34 -07:00
2026-03-14 21:19:22 -07:00
2026-03-10 23:34:52 -07:00
2026-04-19 03:03:57 -07:00
2026-03-28 14:25:12 -07:00
2026-04-21 00:43:50 -07:00
2026-04-20 03:03:07 -07:00
2026-04-18 18:53:31 -07:00
2026-03-27 04:03:13 -07:00
2026-04-04 19:05:34 -07:00
2026-04-10 21:18:34 -07:00
2026-04-10 03:01:59 -07:00
2026-04-16 02:26:14 -07:00
2026-04-16 06:31:23 -07:00
2026-03-26 19:27:58 -07:00
2026-04-11 03:11:34 -07:00
2026-04-06 13:20:01 -07:00
2026-04-19 03:03:57 -07:00
2026-03-22 09:33:39 -07:00
2026-04-17 15:18:23 -07:00
2026-04-20 03:10:19 -07:00
2026-04-21 00:54:46 -07:00
2026-04-12 13:05:56 -07:00
2026-04-21 00:54:46 -07:00
2026-04-21 01:33:10 -07:00
2026-04-07 11:12:08 -07:00
2026-04-09 14:07:32 -07:00
2026-04-20 01:44:36 -07:00
2026-04-17 01:05:09 -07:00
2026-03-27 11:33:19 -07:00
2026-03-15 23:04:34 -07:00
2026-04-19 03:03:57 -07:00
2026-04-21 00:43:50 -07:00
2026-04-18 04:17:18 -07:00
2026-04-02 20:54:27 -07:00
2026-03-01 05:28:12 -08:00
2026-04-19 22:46:47 -07:00
2026-04-11 14:43:53 -07:00
2026-04-14 17:08:35 -07:00
2026-04-15 17:54:43 -07:00
2026-04-07 14:08:59 -07:00
2026-04-11 13:59:52 -07:00
2026-04-20 05:10:23 -07:00
2026-04-17 14:27:26 -07:00
2026-04-21 03:06:56 -07:00
2026-04-20 00:10:22 -07:00
2026-03-27 04:03:13 -07:00
2026-04-16 06:49:36 -07:00
2026-04-13 10:50:24 -07:00
2026-04-10 05:34:33 -07:00
2026-04-12 19:06:20 -07:00
2026-03-17 02:49:57 -07:00
2026-04-15 22:35:19 -07:00
2026-04-21 06:23:09 -07:00
2026-04-19 00:09:38 -07:00
2026-03-14 14:27:20 +03:00
2026-03-04 21:34:40 +03:00
2026-04-19 22:16:37 -07:00
2026-04-05 11:59:28 -07:00
2026-04-05 00:28:58 -07:00
2026-04-12 04:52:59 -07:00
2026-04-21 01:56:35 -07:00
2026-04-11 17:20:34 -07:00
2026-04-19 22:36:00 -07:00
2026-04-19 22:36:00 -07:00
2026-04-12 18:05:41 -07:00
2026-04-07 17:27:09 -07:00
2026-04-19 05:18:19 -07:00
2026-03-28 14:33:35 -07:00
2026-04-07 17:27:09 -07:00
2026-04-19 22:45:08 -07:00
2026-04-11 15:22:49 -07:00
2026-04-17 19:03:29 -07:00
2026-04-17 06:50:36 -07:00
2026-04-20 20:49:32 -07:00
2026-04-12 19:20:13 -07:00
2026-04-20 11:56:19 -07:00
2026-03-17 10:44:37 -07:00
2026-04-14 01:43:45 -07:00
2026-04-13 16:32:04 -07:00