CVE-2026-100544: openclaw voice-call before 2026.8.1 Authorization Bypass
openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller. A caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) on a deployment with inbound calling enabled can therefore drive tools intended for the trusted owner, potentially reading data, modifying files, executing commands, or controlling connected services depending on the agent's configuration. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@openclaw/voice-callto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using @openclaw/voice-call before 2026.8.1 with inbound calling enabled are exposed if a caller can be admitted under the configured inbound-call policy. The affected policies include open, pairing, and allowlist configurations.
What does an attacker need to exploit it?
The attacker needs to place a classic inbound voice call and be admitted by the deployment's inbound-call policy. No additional user interaction is required after the call is accepted.
What can an admitted caller do?
An admitted caller may receive the agent's normal tool authority because owner-only filtering can fail open. Depending on the agent configuration, this can allow reading data, modifying files, executing commands, or controlling connected services.
What can be done if upgrading is not immediately possible?
Disable inbound calling to prevent exploitation through classic inbound voice calls. If inbound calling must remain enabled, restrict admission through the configured inbound-call policy to trusted callers only.
How can I determine whether my deployment is affected?
Check whether @openclaw/voice-call is older than 2026.8.1 and whether inbound calling is enabled. Also review whether the inbound-call policy permits any caller beyond the trusted owner, including through open, pairing, or allowlist admission.