rootpwn

critical · CVSS v3 8.8 · CVSS v4 8.7 · EPSS 0.00246

CVE-2026-100544

CVE-2026-100544 exposes the openclaw/voice-call package to remote callers who can trigger owner‑only tools without identity verification. Th

Overview

CVE-2026-100544 exposes the openclaw/voice-call package to remote callers who can trigger owner‑only tools without identity verification. The flaw allows attackers to read, modify, or execute commands on the agent. It is fixed in version 2026.8.1.

Description

openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller. A caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) on a deployment with inbound calling enabled can therefore drive tools intended for the trusted owner, potentially reading data, modifying files, executing commands, or controlling connected services depending on the agent's configuration. The issue is fixed in 2026.8.1.

Impact

Confidentiality and integrity of data handled by the agent are compromised when a remote caller can invoke privileged tools. Availability may also be affected if malicious commands disrupt services. Defenders of deployments using inbound voice calls are directly impacted.

Remediation

Upgrade to openclaw/voice-call 2026.8.1 or later. Disable inbound calling if not required, or enforce strict owner‑only policies. Verify that caller identity is propagated and monitor logs for unauthorized tool usage.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 8.8, but the EPSS score of 0.00246 indicates a low likelihood of exploitation. Defenders should prioritize patching while maintaining vigilance.

Affected products

  • openclaw/voice-call
  • openclaw
  • voice-call

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
8.7
EPSS
0.00246

critical inbound-call voice-call openclaw privilege-escalation patch authentication-bypass

← All CVEs

Related CVEs

critical

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.

View analysis

critical

CVE-2026-100520

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

View analysis

critical

CVE-2026-100551

OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an attacker able to redirect the same host and port and present a different certificate that is accepted by iOS system trust can serve a replacement Control UI page; opening the Terminal or a session Dashboard then allows that page to read the injected Gateway token or password. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. This issue is fixed in 2026.8.11.

View analysis

critical

CVE-2026-100552

OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a lower-trust conversation was assigned to a Codex runtime and restricted with a per-chat tool allowlist, a participant able to trigger that agent could still reach native command and file tools, bypassing the configured allowlist. The practical impact depends on the runtime's host permissions and sandbox configuration. The issue is fixed in 2026.8.1.

View analysis