Security vulnerabilities and automated fixes for plaintext secrets issues
1 post found
A critical security vulnerability was discovered in the `telegrambot/99-telegrambot.html` file where the Telegram bot token was registered as a Node-RED credential of type `'text'` instead of `'password'`. This meant the token was transmitted in plaintext over the admin API and stored without obfuscation in `flows_cred.json`, allowing attackers with filesystem or network access to recover the bot token and take full control of the Telegram bot.