Bug Report

Summary

After updating from 2026.2.19-2 to 2026.2.22-2, Telegram media (images) can no longer be downloaded. The SSRF protection is incorrectly blocking requests to api.telegram.org.

Error

SsrFBlockedError: Blocked: resolves to private/internal/special-use IP address
MediaFetchError: Failed to fetch media from https://api.telegram.org/file/bot.../photos/file_142.jpg

Log

{"subsystem":"security"} blocked URL fetch (url-fetch) target=https://api.telegram.org/file/bot.../photos/file_142.jpg reason=Blocked: resolves to private/internal/special-use IP address

Steps to Reproduce

1. Use openclaw with Telegram channel configured
2. Send an image via Telegram
3. openclaw fails to download the media with SsrFBlockedError

Expected Behavior

Images sent via Telegram should be downloaded successfully, as they were in 2026.2.19-2.

Actual Behavior

All Telegram media downloads fail with SSRF block error after updating to 2026.2.22-2.

Timeline

• 2026.2.19-2: ✅ Telegram images work fine (confirmed working earlier today)
• 2026.2.22-2: ❌ All Telegram media blocked by SSRF protection

Environment

• openclaw: 2026.2.22-2
• OS: macOS Darwin 24.6.0 (arm64)
• Channel: Telegram
• Node: v25.4.0

Possible Cause

The SSRF protection changes in 2026.2.22 may have tightened IP allowlist rules, causing api.telegram.org to resolve to an IP that is now incorrectly classified as private/internal.