{
  "slug": "telegram-desktop-cve-2026-107181",
  "category": "patch",
  "title": "Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)",
  "summary": "CVE-2026-107181 (CVSS 8.1) in Telegram Desktop before 7.2.9 lets a crafted tg:// link inject IPC commands and exfiltrate tdata session files, enabling account takeover without the password/2FA. Fixed in 7.2.9 (mid-September); continued discussion into early October.",
  "cveIds": [
    "CVE-2026-107181"
  ],
  "product": "Telegram Desktop",
  "severity": "high",
  "severityNote": "CVSS 8.1 (High)",
  "status": "closed",
  "startedAt": "2026-09-16",
  "closedAt": "2026-09-16",
  "patchStatus": "patched",
  "affectedVersions": [
    "Before 7.2.9"
  ],
  "fixedVersions": [
    "7.2.9+"
  ],
  "timeline": [
    {
      "date": "2026-09-16",
      "title": "Telegram Desktop 7.2.9 ships the fix."
    },
    {
      "date": "2026-10-08/10",
      "title": "Public write-ups and X discussion peak."
    }
  ],
  "sources": [
    {
      "kind": "advisory",
      "title": "beaksec write-up",
      "url": "https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/",
      "publisher": "beaksec",
      "date": "2026-10"
    },
    {
      "kind": "news",
      "title": "OpenCVE CVE-2026-107181",
      "url": "https://app.opencve.io/cve/CVE-2026-107181",
      "publisher": "OpenCVE",
      "date": "2026-10"
    }
  ],
  "tweets": [],
  "notes": "Included as a recent developer-facing desktop issue; fewer high-quality X posts captured in this pass. Prefer the technical write-up over social chatter.",
  "grouping": "none",
  "updatedAt": "2026-10-22T11:20:00+02:00",
  "stacks": [],
  "tags": [
    "telegram"
  ],
  "url": "https://pwn.watch/i/telegram-desktop-cve-2026-107181",
  "json": "https://pwn.watch/i/telegram-desktop-cve-2026-107181.json",
  "sections": [],
  "agentBrief": "# Security brief: Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)\n\nSource: https://pwn.watch/i/telegram-desktop-cve-2026-107181 · status: closed (closed Sep 16, 2026) · severity: high · updated Oct 22, 2026, 11:20 UTC\n\n## Patch status\n**PATCHED: fixed releases exist. Upgrade to a fixed version.**\n\n## What it is\nCVE-2026-107181 (CVSS 8.1) in Telegram Desktop before 7.2.9 lets a crafted tg:// link inject IPC commands and exfiltrate tdata session files, enabling account takeover without the password/2FA. Fixed in 7.2.9 (mid-September); continued discussion into early October.\n\nSeverity detail: CVSS 8.1 (High)\n\n- Product: Telegram Desktop\n- CVE / advisory ids: CVE-2026-107181\n\n## Affected versions\n- Before 7.2.9\n\n## Check whether you're affected\nNo generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.\n\n## Fix\nUpgrade to one of these fixed versions (or later on the same branch):\n- 7.2.9+\n\nAfter upgrading, re-run the checks above and redeploy/restart the affected services.\n\n## Secrets to rotate\nThis incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.\n\n## Latest updates\n- Oct 8/10, 2026: Public write-ups and X discussion peak.\n- Sep 16, 2026: Telegram Desktop 7.2.9 ships the fix.\n\n## Advisories\n- [beaksec write-up](https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/) (beaksec)\n\n## Write-ups & news\n- [OpenCVE CVE-2026-107181](https://app.opencve.io/cve/CVE-2026-107181)\n\n## Caveats\nIncluded as a recent developer-facing desktop issue; fewer high-quality X posts captured in this pass. Prefer the technical write-up over social chatter.\n\n---\nMachine-readable: https://pwn.watch/i/telegram-desktop-cve-2026-107181.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems."
}