Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

OpenClaw version: 2026.3.28
Channel: Telegram
File size: Any, but large files (15MB+) more likely to trigger consistently

Description:
Since the 2026.3.28 update, PDF files (and other media) sent via Telegram fail to download with the error: "⚠️ Failed to download media. Please try again."

Gateway logs show:
[security] blocked URL fetch (url-fetch) target=https://api.telegram.org/file/bot.../documents/file_XX.pdf reason=Blocked: resolves to private/internal/special-use IP address

Root cause identified:
In auth-profiles-B5ypC5S-.js, the Telegram SSRF policy sets allowRfc2544BenchmarkRange: false, while Discord, Signal, and other channels set it to true. When Telegram's CDN file servers resolve to RFC 2544 benchmark range IPs, the SSRF check blocks the download.

The relevant code in auth-profiles-B5ypC5S-.js line ~130072:
function buildTelegramMediaSsrfPolicy(apiRoot) { return { hostnameAllowlist: hostnames, ...allowedHostnames ? { allowedHostnames } : {}, allowRfc2544BenchmarkRange: false // ← This is the problem }; }

Compare with Discord's policy (line ~199026):
allowRfc2544BenchmarkRange: true // ← Discord allows it

Expected behavior:
Telegram media downloads should succeed, just as Discord, Signal, and other channels do for the same CDN IP ranges.

Suggested fix:
Either:

1. Change allowRfc2544BenchmarkRange: false → true for Telegram media SSRF policy, OR
2. Make it configurable via channels.telegram.mediaSsrfPolicy.allowRfc2544BenchmarkRange

Workaround: None via config — the SSRF policy is hardcoded in the bundle.

Steps to reproduce

Since the 2026.3.28 update, PDF files (and other media) sent via Telegram fail to download with the error: "⚠️ Failed to download media. Please try again."

Expected behavior

Expected behavior:
Telegram media downloads should succeed, just as Discord, Signal, and other channels do for the same CDN IP ranges.

Actual behavior

PDF files (and other media) sent via Telegram fail to download with the error: "⚠️ Failed to download media. Please try again."

OpenClaw version

2026.3.28

Operating system

MacOS 26.3.1 (25D2128)

Install method

npm global

Model

minimax m2.7

Provider / routing chain

openclaw->opentourter->minimaxm2.7

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response