P2 Telegram Supergroup Auth Completely Broken — Allowlists Ignored, Only Owner Can Message (#55462)
Executive Summary
In Telegram supergroups, Hermes blocks ALL additional users regardless of configuration. The owner can message normally, but every other user — even when correctly added to TELEGRAM_ALLOWED_USERS and TELEGRAM_GROUP_ALLOWED_USERS — is blocked with: [Telegram] Blocked unauthorized user 1869xxxxxx in chat -1002xxxxxxxx. Ten different configuration attempts all failed. Telegram supergroups — a primary use case for team Hermes deployments — are functionally single-user. This is the 7th distinct Telegram/gateway bug we've tracked.
Everything the Reporter Tried (All Failed)
| Attempt | Configuration | Result |
|---|---|---|
| 1 | TELEGRAM_ALLOWED_USERS=1869xxxxxx | BLOCKED |
| 2 | TELEGRAM_GROUP_ALLOWED_USERS=1869xxxxxx | BLOCKED |
| 3 | TELEGRAM_GROUP_ALLOWED_CHATS=-1002xxxxxxxx | BLOCKED |
| 4 | group_allowed_users: [1869xxxxxx] in config.yaml | BLOCKED |
| 5 | allowed_users: [1869xxxxxx] in config.yaml | BLOCKED |
| 6 | GATEWAY_ALLOW_ALL_USERS=true | BLOCKED |
| 7 | block_unauthorized_users: false | BLOCKED |
| 8 | auth_mode: open | BLOCKED |
| 9 | unauthorized_policy: allow | BLOCKED |
| 10 | Disabled Group Privacy in @Botfather + re-added bot | BLOCKED |
After all 10 attempts and multiple gateway restarts, only the owner can interact. Additional users blocked in both supergroups and DMs. The auth/authorization subsystem appears to have a fundamental disconnect between configuration and runtime enforcement.
Impact Assessment
| Dimension | Severity | Detail |
|---|---|---|
| Team Functionality | CRITICAL | Telegram supergroups — a primary use case for team Hermes deployments — are functionally single-user. Any team deployment via Telegram is blocked. |
| Configuration Trust | HIGH | 10 different configuration paths all failed identically — users can't trust that any auth configuration will be honored |
| Debug Difficulty | HIGH | No configuration produced a different result — no diagnostic signal to narrow the root cause |
| Platform Scope | HIGH | Affects Telegram supergroups and DMs — the primary messaging platform for many Hermes deployments |
| Fix Complexity | HIGH | Auth/authorization subsystem disconnect — configuration is parsed but runtime enforcement ignores it. Requires tracing the full auth pipeline from config to enforcement. |
Telegram/Gateway Bug History (7 Distinct Issues)
| Issue | Severity | Description |
|---|---|---|
| #40691 | P2 | Polling-conflict freeze |
| #39525 | P2 | Dead after sleep/Wi-Fi disconnect |
| #44679 | P2 | Matrix DM regression |
| #50218 | P2 | Markdown table stripping in messages |
| #51961 | P2 | Streaming final message broken |
| #53697 | P2 | Per-platform streaming bypasses global kill switch |
| #55462 | P2 | Supergroup auth completely broken — allowlists ignored, only owner can message |
⚠️ Pattern: Seven distinct Telegram/gateway bugs spanning polling, connectivity, cross-platform message formatting, streaming, and now authorization. The gateway layer — the bridge between Hermes and messaging platforms — has accumulated the most diverse failure modes of any subsystem. Each bug affects a different part of the gateway pipeline, suggesting the entire pipeline needs systematic audit rather than point fixes.
Source Evidence
- GitHub Issue: #55462 — Telegram Supergroup Auth Completely Broken
- Opened: June 30, 2026
- Reporter: @jhrg89
- Labels: P2, area/auth, bug, comp/gateway, needs-repro, platform/telegram, type/bug
- OS: Ubuntu on Windows
- Debug report: paste.rs/l1XEu
- Related PRs: #55496 and #55529 already open
- Reporter willing to submit PR: Yes
- All five logs provided
📋 https://hermes-agent.reviews/hermes-telegram-supergroup-auth-broken-55462.html
Tracked by hermes-agent.reviews — June 30, 2026