VulnSocial

CVE-2026-26319Disclosure(openclaw / openclaw)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbound webhook requests when telnyx.publicKey is not configured, enabling unauthenticated callers to forge Telnyx events. Telnyx webhooks are expected to be authenticated via Ed25519 signature verification. In affected versions, TelnyxProvider.verifyWebhook() could effectively fail open when no Telnyx public key was configured, allowing arbitrary HTTP POST requests to the voice-call webhook endpoint to be treated as legitimate Telnyx events. This only impacts deployments where the Voice Call plugin is installed, enabled, and the webhook endpoint is reachable from the attacker (for example, publicly exposed via a tunnel/proxy). The issue has been fixed in version 2026.2.14.

openclaw CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-02-18); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
openclaw
Products
openclaw

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-02-18: 1Mentions · 2026-02-20: 1Technical Details · 2026-02-18: 1Technical Details · 2026-02-20: 102-1802-20
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-26319 OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbound web… https://www.cve.org/CVERecord?id=CVE-2026-26319

    Post summary

    CVE-2026-26319 reveals that OpenClaw versions 2026.2.13 and earlier allow the @openclaw/voice-call plugin’s Telnyx webhook handler to accept unsigned inbound requests, potentially leading to unauthorized access as documented in the CVE record.

    00000135
    56.4K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 OpenClaw, Authentication Bypass, #CVE-2026-26319 (High) https://dailycve.com/openclaw-authentication-bypass-cve-2026-26319-high/

    Post summary

    A new high‑severity authentication bypass vulnerability (CVE‑2026‑26319) in OpenClaw has been disclosed.

    0000036
    162 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities