🟡 [MEDIUM] CB-016: Telegram Auto-Adds Unknown Groups #25

New issue

Closed

opened 2026-02-20 08:50:04 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:04 +00:00

Security Finding from Audit

Parent issue: #1

Severity

MEDIUM 🟡

CVSS Score

N/A

CWE

CWE-862 (Missing Authorization)

Location

telegram/plugin.py, poll_updates()

Description

Any Telegram group that messages the bot is automatically added to the active groups list: self._groups[chat_id] = GroupConfig(...)

This means anyone who adds the bot to a group gains access to the agent, bypassing the intended group whitelist configuration. While the pairing plugin provides user-level auth, the auto-add behavior expands the attack surface.

Recommendation

Only process messages from explicitly configured groups. Log and ignore messages from unknown groups.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-016

## Security Finding from Audit > Parent issue: #1 ### Severity **MEDIUM** 🟡 ### CVSS Score N/A ### CWE CWE-862 (Missing Authorization) ### Location `telegram/plugin.py, poll_updates()` --- ### Description Any Telegram group that messages the bot is automatically added to the active groups list: `self._groups[chat_id] = GroupConfig(...)` This means anyone who adds the bot to a group gains access to the agent, bypassing the intended group whitelist configuration. While the pairing plugin provides user-level auth, the auto-add behavior expands the attack surface. --- ### Recommendation Only process messages from explicitly configured groups. Log and ignore messages from unknown groups. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-016*