[Bug]: Telegram media download fails after v2026.2.22 - SSRF blocks 198.18.x.x #24973
Description
Summary
I send a photo on Telegram to my OpenClaw bot today，and he replied like:
but one day before I upgrade, he can reply. so I downgrade the version to 2026.2.21-2, now he can reply now like (with a warning that The configuration file was created using the new version 2026.2.22-2):
he review the issue himself and find out that might be a SSRF blocks:
Problem Summary
Root Cause: api.telegram.org resolves to 198.18.0.153, which is a RFC2544 benchmark reserved IP segment (198.18.0.0/15). OpenClaw's SSRF security protection misjudged this IP segment as "private/internal IP" and blocked access to it.
Impact: Unable to download images/media files sent by Telegram group members.
This is a bug in OpenClaw — Telegram officially does use this IP segment as a file server and it shouldn't be blocked.
───
please help check this, thanks!
Steps to reproduce
- upgrade OpenClaw to v2026.2.22
- send a photo to OpenClaw Bot on Telegram
Expected behavior
telegram bot can read this photo and reply
Actual behavior
telegram bot can not read this photo
OpenClaw version
2026.2.22
Operating system
macOS 26.2 (25C56)
Install method
No response
Logs, screenshots, and evidence
Impact and severity
No response
Additional information
No response