EUVD-2026-87506
GHSA-3w3q-3hpq-fv5m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlace inbound voice call to agent
-
DeliveryGet admitted by inbound-call policy
-
ExploitCaller identity not propagated (fails open)
-
ExecutionInvoke owner-only agent tools
-
ImpactExecute commands / read data / control services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the deployment has inbound calling enabled in @openclaw/voice-call AND that the attacker's call is admitted by the configured inbound-call policy - 'open' (any caller admitted, effectively unauthenticated), 'pairing', or 'allowlist' (attacker must be a paired/listed caller). The flaw only triggers for classic inbound voice calls where caller identity/non-owner status is not propagated, causing owner-only tool filtering to fail open. Realistic impact is further bounded by the specific tools and connected services the agent is configured with - a minimally-provisioned agent exposes little, while one wired to shell/file/service tools yields command execution. It does not affect deployments with inbound calling disabled or restrictive allowlists that exclude the attacker. |
| Impact | This is a genuine authorization-bypass (CWE-862) in OpenClaw's @openclaw/voice-call package that can escalate to full agent-tool abuse. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H = 8.7) is consistent with the description: a network caller admitted by the inbound-call policy can drive tools reserved for the trusted owner, yielding high confidentiality, integrity, and availability impact (potential file modification, command execution, and control of connected services). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis' - real risk is bounded by two deployment prerequisites rather than by attack difficulty. The signals are internally consistent (network vector, low complexity, no user interaction), but PR:L is generous for the 'open' inbound-call policy where any caller is admitted (arguably PR:N there) and slightly understated for allowlist mode; the single PR:L reflects the middle case. Net: a real, prioritize-if-exposed issue for deployments that have inbound calling turned on, not a paper high-CVSS finding - but its footprint is limited to that specific opt-in configuration on a niche framework. |
| Exploit ScenarioDerived | An operator runs an OpenClaw agent with @openclaw/voice-call inbound calling enabled and an 'open' or pairing/allowlist admission policy. A remote caller dials in, is admitted by the policy, and - because the caller's non-owner identity is never propagated - the owner-only tool filter fails open, letting the caller instruct the agent to read data, edit files, or run commands with the agent's full tool authority. No public proof-of-concept is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Authorization bypass in the @openclaw/voice-call package before version 2026.8.1 lets a remote caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) drive the agent's owner-only tools, because the caller's identity and non-owner status are not propagated on classic inbound voice calls. The owner-only tool filter therefore fails open, allowing data reads, file modification, command execution, or control of connected services depending on how the agent is provisioned. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 4.0 base 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis. Deployments with inbound calling disabled, or whose allowlist excludes the attacker, are not affected.
RemediationAI
Upgrade @openclaw/voice-call to 2026.8.1 or later - vendor-released patch: 2026.8.1 - which restores propagation of caller identity and non-owner status so that owner-only tool filtering no longer fails open; see GHSA-rrxp-5mx8-mvhh (https://github.com/openclaw/openclaw/security/advisories/GHSA-rrxp-5mx8-mvhh) for the vendor's fixed-version guidance. Where immediate upgrade is not possible, the most effective compensating control is to disable inbound calling entirely, which eliminates the vulnerable code path at the cost of losing voice-call functionality; a narrower alternative is to move the inbound-call policy from 'open' to 'pairing' or a tight 'allowlist' so that only explicitly trusted callers are admitted, though this does not fix the underlying fail-open behavior and an attacker who is already paired or listed still reaches owner-level tools. As an additional containment measure, reduce the agent's tool authority - disconnect shell, filesystem-write, and service-control tools from any agent reachable by inbound voice calls - accepting the trade-off that this degrades the agent's legitimate capabilities, and monitor the vendor advisory for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-862 (Missing Authorization) in the call-handling path of the @openclaw/voice-call package, an inbound voice-call front end for OpenClaw agents. In a correctly functioning flow, the identity and owner/non-owner status of the caller should be attached to the invocation context so that owner-only tool filtering can decide which tools the agent may exercise. On classic inbound voice calls before 2026.8.1, that context is not propagated, so the authorization check has nothing to evaluate against and defaults to permitting access - a fail-open condition that grants the remote caller the same tool authority as the trusted owner. The affected component is tracked by CPE cpe:2.3:a:openclaw:voice-call:*:*:*:*:*:*:*:* (all versions prior to 2026.8.1). The practical blast radius is bounded by the agent's configuration: a minimally provisioned agent exposes little, while an agent wired to shell, filesystem, or service-control tools becomes a route to command execution and data manipulation. Per the independent assessment, the exploitation prerequisite is that inbound calling is enabled and the attacker's call is admitted by the configured inbound-call policy; under an 'open' policy any caller is admitted, making the flaw effectively unauthenticated in that configuration, whereas pairing or allowlist policies require the attacker to be a paired or listed caller.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote caller admitted by inbound policy = PR:L (PR:N in open mode); no UI; owner-tool authority yields full C/I/A within the agent process, no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller. A caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) on a deployment with inbound calling enabled can therefore drive tools intended for the trusted owner, potentially reading data, modifying files, executing commands, or controlling connected services depending on the agent's configuration. The issue is fixed in 2026.8.1.
Articles & Coverage 1
Technical POC Analysis
CWE-862 (Missing Authorization).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity authorization bypass in the @openclaw/voice-call package allows any caller who passes the configured inbound-call policy (open, pairing, or allowlist) to invoke the voice agent's owner-only tools, effectively granting an outsider the same capabilities as the account owner. Because the flaw fails open, affected organizations could face unauthorized data reads, file modification, command execution, or control of services connected to the agent - with high impact to confidentiality, integrity, and availability. Leadership should care because the exposure is reachable from the public telephone network in any deployment that accepts inbound calls, and the required attacker effort is low.
No vendor-released patch identified at time of analysis; the advisory references version 2026.8.1 as the fixed release, so confirm availability with the vendor before relying on it. Until then: disable inbound calling entirely, or restrict the inbound-call policy to a strict allowlist so that an attacker cannot be admitted (deployments with inbound calling disabled or whose allowlist excludes the attacker are not affected); minimize each agent's provisioned owner-only tools and reduce credentials for connected services to least privilege; isolate voice-agent hosts from sensitive internal networks; and monitor inbound call admission and owner-only tool activity for anomalous invocations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB