CVE-2026-100544 Overview
CVE-2026-100544 is an authorization bypass [CWE-862] in openclaw's @openclaw/voice-call package before version 2026.8.1. The package launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. Owner-only tool filtering fails open, exposing the agent's full tool authority to remote callers admitted by the inbound-call policy. Depending on the agent configuration, a caller can read data, modify files, execute commands, or control connected services. The maintainers fixed the issue in 2026.8.1.
Critical Impact
Remote callers admitted by open, pairing, or allowlist inbound-call policies inherit owner-level tool access, enabling data theft, file modification, command execution, and control of connected services.
Affected Products
- openclaw @openclaw/voice-call package versions prior to 2026.8.1
- Deployments with inbound calling enabled
- Agents configured with owner-only tool filtering relying on identity propagation
Discovery Timeline
- 2026-09-26 - CVE-2026-100544 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100544
Vulnerability Analysis
The flaw is a missing authorization check in the inbound voice-call handler. When a classic inbound call arrives, @openclaw/voice-call instantiates the configured agent session without attaching the caller's identity context or a non-owner flag. Downstream tool filtering logic expects that context to decide whether to expose owner-only tools. Without it, the filter fails open and every registered tool becomes callable by the remote party.
The practical impact depends on the agent's tool catalog. If the agent is wired to filesystem, shell, database, or API-automation tools, a caller can drive them directly over the voice channel. The vulnerability does not require authentication beyond passing the inbound-call policy, which may be as permissive as open or an allowlist of phone numbers or pairing codes.
Root Cause
The root cause is a broken trust boundary between the call-admission layer and the agent-execution layer. Admission policy and owner-only tool filtering were designed as independent controls, but the call handler failed to pass the identity signal that the filter requires. This matches [CWE-862: Missing Authorization], where an action proceeds without verifying the actor is permitted to perform it.
Attack Vector
An attacker places an inbound voice call to a deployment with inbound calling enabled. If the configured policy admits the call (open mode, a known pairing code, or a spoofed/approved allowlist entry), the agent session starts with full tool authority. The attacker then issues natural-language instructions during the call to invoke owner-reserved tools. See the GitHub Security Advisory GHSA-rrxp-5mx8-mvhh and the VulnCheck Advisory for additional technical detail.
// No verified exploit code is published for CVE-2026-100544.
// Refer to the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-100544
Indicators of Compromise
- Inbound voice-call sessions originating from numbers or pairing identifiers not associated with the configured owner.
- Agent tool-invocation logs showing owner-reserved tools called within a session initiated by an inbound call.
- Unexpected filesystem writes, shell commands, or outbound API calls correlated in time with inbound-call session identifiers.
Detection Strategies
- Correlate call-session identifiers with agent tool-execution logs and alert when non-owner sessions invoke owner-only tools.
- Inventory deployments running @openclaw/voice-call and flag any version earlier than 2026.8.1.
- Review inbound-call policy configuration for open or broad allowlist entries that permit untrusted callers.
Monitoring Recommendations
- Enable verbose session logging in the agent runtime to capture caller identity, tool name, arguments, and outcome.
- Forward call-handler and agent logs to a central analytics platform and build detections for owner-tool invocation without an owner identity attribute.
- Monitor outbound network traffic and filesystem change events on hosts running the agent for post-exploitation behavior.
How to Mitigate CVE-2026-100544
Immediate Actions Required
- Upgrade @openclaw/voice-call to version 2026.8.1 or later on all deployments.
- Disable inbound calling until the upgrade is validated if the deployment is internet-reachable.
- Audit the agent's tool catalog and remove or restrict high-impact tools (shell, filesystem, database, outbound HTTP) that are not required.
Patch Information
The maintainers fixed the vulnerability in @openclaw/voice-call version 2026.8.1. The fix propagates caller identity and non-owner status into the agent session so that owner-only tool filtering evaluates correctly. See the GitHub Security Advisory GHSA-rrxp-5mx8-mvhh for full remediation notes.
Workarounds
- Set the inbound-call policy to the strictest option available and remove open mode.
- Replace broad allowlists with a short list of verified owner numbers or rotate pairing codes frequently.
- Reconfigure the agent to omit owner-only tools from any configuration used by inbound-call sessions.
# Update the package to the patched release
npm install @openclaw/voice-call@2026.8.1
# Verify the installed version
npm ls @openclaw/voice-call
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
