Junglewise Threat Intelligence

CVE-2026-26319: OpenClaw Voice Call missing webhook authentication in Telnyx provider

CVE-2026-26319 · Severity: low · CVSS 3.1 · Published 2026-02-17

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw's optional Voice Call plugin contains a flaw in how it validates incoming Telnyx webhook requests when the Telnyx public key is not configured. Without proper verification, an attacker can forge voice call events (such as fake incoming calls or hangups) to trigger actions in systems using this plugin. This impacts deployments where the Voice Call plugin is enabled and its webhook endpoint is accessible from the internet.

Technical details

The TelnyxProvider.verifyWebhook() function in OpenClaw's @openclaw/voice-call plugin fails to validate Ed25519 signatures on inbound webhook requests when telnyx.publicKey is not configured, causing signature verification to silently pass. This is a missing authentication vulnerability (CWE-306) exploitable via network access to the voice-call webhook endpoint. An unauthenticated attacker with network reachability to the publicly exposed webhook can send arbitrary POST requests to forge Telnyx events, potentially triggering unauthorized voice call actions. The fix makes webhook verification fail closed by default and mandates telnyx.publicKey configuration. A bypass flag (skipSignatureVerification: true) exists only for local development and emits startup warnings.

Affected products

  • OpenClaw openclaw <= 2026.2.13

Timeline

  • 2026-02-17: disclosed
  • 2026-02-14: patched: Fix commits authored 2026-02-14; patch release 2026.2.14 planned

References