Authorization Bypass in Openclaw's Voice-call Package

CVE-2026-100544

What is CVE-2026-100544?

The @openclaw/voice-call package prior to version 2026.8.1 contains a significant vulnerability where the configured agent is launched for inbound voice calls without properly propagating the caller's identity or non-owner status. This oversight can lead to critical failures in owner-only tool filtering, allowing an unauthorized caller access to the agent's tool authority. If an attacker is granted access based on the deployment's inbound-call policy, they could potentially manipulate trusted owner tools to read sensitive data, modify files, execute commands, or gain control over associated services. The vulnerability was addressed in version 2026.8.1.

References