Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Regression in 2026.3.28: Telegram image/media download fails with 'Failed to download media' [1 pull requests, 2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#57412•Fetched 2026-04-08 01:49:56
View on GitHub
Comments
2
Participants
3
Timeline
6
Reactions
0
Author
lazica-hublazica-hub
Participants
a823480758-ossa823480758-osslazica-hublazica-hubsteipetesteipete
Timeline (top)
commented ×2closed ×1cross-referenced ×1locked ×1

After upgrading OpenClaw from 2026.3.24 to 2026.3.28, Telegram image/media messages stopped working for my bots. Text messages still worked, but image uploads sent to the bot failed with:

Failed to download media. Please try again.

Rolling back to 2026.3.24 restored image receiving immediately.

Error Message

MediaFetchError: Failed to fetch media from https://api.telegram.org/file/bot.../photos/file_X.jpg: Blocked: resolves to private/internal/special-use IP address

Root Cause

After upgrading OpenClaw from 2026.3.24 to 2026.3.28, Telegram image/media messages stopped working for my bots. Text messages still worked, but image uploads sent to the bot failed with:

Failed to download media. Please try again.

Rolling back to 2026.3.24 restored image receiving immediately.

Fix Action

Fix / Workaround

  1. Start from a working Telegram bot setup on 2026.3.24
  2. Upgrade to 2026.3.28
  3. Send an image to the bot on Telegram
  4. Observe failure: Failed to download media. Please try again.
  5. Check logs and see the blocked api.telegram.org/file/... fetch
  6. Roll back to 2026.3.24
  7. Send an image again
  8. Observe normal behavior restored

PR fix notes

PR #57444: fix(telegram): add api.telegram.org to SSRF allowedHostnames to fix media download regression

Description (problem / solution / changelog)

## Problem

After upgrading OpenClaw to 2026.3.28, Telegram image/media messages fail with:

MediaFetchError: Failed to fetch media from https://api.telegram.org/file/bot.../photos/file_X.jpg: Blocked: resolves to private/internal/special-use IP address

Text messages still work normally. Rolling back to 2026.3.24 restores media downloads.

Root Cause

buildTelegramMediaSsrfPolicy in extensions/telegram/src/bot/delivery.resolve-media.ts sets hostnameAllowlist: ["api.telegram.org"] (restricting which hosts can be fetched) but does not include api.telegram.org in allowedHostnames for the default case.

Without allowedHostnames, the SSRF guard still performs DNS resolution IP checks on api.telegram.org. If any resolved IP falls into a "private/internal/special-use" range (e.g. Telegram CDN edge IPs that overlap with RFC2544 or other special-use blocks), the download is blocked.

The existing test file (fetch.network-policy.test.ts) explicitly passes allowedHostnames: ["api.telegram.org"] in its SSRF policy, which masked the production mismatch.

Fix

Always include api.telegram.org in allowedHostnames so the SSRF guard skips DNS-resolved IP checks for this trusted public API endpoint. The hostnameAllowlist still restricts downloads to only the configured Telegram API hosts.

For custom apiRoot configurations, the custom host is now also added to allowedHostnames alongside api.telegram.org.

Test Plan

  • Updated delivery.resolve-media-retry.test.ts assertions to match the new default SSRF policy (allowedHostnames always includes api.telegram.org)
  • Updated custom apiRoot test to verify both hosts appear in allowedHostnames
  • Verified existing fetch.network-policy.test.ts tests already use the corrected policy shape

Closes #57412

Changed files

  • extensions/telegram/src/bot/delivery.resolve-media-retry.test.ts (modified, +2/-1)
  • extensions/telegram/src/bot/delivery.resolve-media.ts (modified, +2/-8)

Code Example

media fetch failed
Blocked: resolves to private/internal/special-use IP address
https://api.telegram.org/file/bot.../photos/file_X.jpg

---

MediaFetchError: Failed to fetch media from https://api.telegram.org/file/bot.../photos/file_X.jpg: Blocked: resolves to private/internal/special-use IP address
RAW_BUFFERClick to expand / collapse

Summary

After upgrading OpenClaw from 2026.3.24 to 2026.3.28, Telegram image/media messages stopped working for my bots. Text messages still worked, but image uploads sent to the bot failed with:

Failed to download media. Please try again.

Rolling back to 2026.3.24 restored image receiving immediately.

Environment

  • OpenClaw 2026.3.28 (broken)
  • OpenClaw 2026.3.24 (works after rollback)
  • macOS host
  • Telegram direct chats
  • Multi-account Telegram setup (default, lz, tz)

What changed

The only meaningful change was upgrading to 2026.3.28.

Symptoms

  • Text messages to the Telegram bot were delivered normally
  • Image messages to the bot failed
  • This affected multiple Telegram bot accounts, not just one session
  • Restarting the gateway did not fix it
  • Rolling back to 2026.3.24 fixed it

Relevant logs

On 2026.3.28, logs showed Telegram media fetch failures like:

media fetch failed
Blocked: resolves to private/internal/special-use IP address
https://api.telegram.org/file/bot.../photos/file_X.jpg

More specifically, the gateway logged errors in this shape:

MediaFetchError: Failed to fetch media from https://api.telegram.org/file/bot.../photos/file_X.jpg: Blocked: resolves to private/internal/special-use IP address

Expected behavior

Telegram image/media attachments should continue to download normally from api.telegram.org/file/....

Actual behavior

OpenClaw 2026.3.28 appears to block Telegram file downloads through SSRF/private-network protection, causing inbound Telegram image/media handling to fail.

Reproduction

  1. Start from a working Telegram bot setup on 2026.3.24
  2. Upgrade to 2026.3.28
  3. Send an image to the bot on Telegram
  4. Observe failure: Failed to download media. Please try again.
  5. Check logs and see the blocked api.telegram.org/file/... fetch
  6. Roll back to 2026.3.24
  7. Send an image again
  8. Observe normal behavior restored

Notes

I also tried restarting the gateway on 2026.3.28, but the problem remained.

This looks like a regression in Telegram media download handling or SSRF/IP classification for Telegram file URLs.

extent analysis

Fix Plan

The fix involves updating the SSRF protection configuration in OpenClaw to correctly handle Telegram file downloads.

Step-by-Step Solution

  1. Update OpenClaw Configuration: Add api.telegram.org to the list of allowed domains for SSRF protection.
  2. Modify IP Classification: Ensure that the IP classification for api.telegram.org is not marked as private/internal/special-use.

Example Code Snippet

# Update allowed domains for SSRF protection
allowed_domains = ["api.telegram.org"]

# Modify IP classification
ip_classification = {
    "api.telegram.org": "public"
}

Configuration Changes

  • Update the openclaw.config file to include the new allowed domain:
ssrf_protection:
  allowed_domains:
    - api.telegram.org

Verification

  1. Send an image to the Telegram bot after applying the fix.
  2. Check the logs for successful media fetches from api.telegram.org/file/....
  3. Verify that the image is downloaded correctly and displayed in the bot.

Extra Tips

  • Ensure that the OpenClaw configuration is properly updated and restarted after applying the fix.
  • Monitor the logs for any further issues related to SSRF protection or IP classification.
  • Consider adding additional logging or monitoring to detect similar issues in the future.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Telegram image/media attachments should continue to download normally from api.telegram.org/file/....

#api#ssr#network issue#logging issue#authentication issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix Regression in 2026.3.28: Telegram image/media download fails with 'Failed to download media' [1 pull requests, 2 comments, 3 participants]