CVE-2026-26319: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26319 is a missing webhook authentication vulnerability in OpenClaw's optional @openclaw/voice-call plugin that allows unauthenticated attackers to forge Telnyx call events. It affects OpenClaw versions 2026.2.13 and below (npm package) and was disclosed on February 15, 2026, with a patch released the same day in version 2026.2.14. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, OpenClaw Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function): the TelnyxProvider.verifyWebhook() function in the @openclaw/voice-call plugin failed open when telnyx.publicKey was not configured, accepting any arbitrary HTTP POST request to the voice-call webhook endpoint as a legitimate Telnyx event. Telnyx webhooks are designed to be authenticated via Ed25519 signature verification using the telnyx-signature-ed25519 and telnyx-timestamp headers, but the absence of a configured public key caused the verification logic to bypass this check entirely. The fix (commits 29b587e and f47584f) inverts the default behavior to fail closed — requiring telnyx.publicKey (or the TELNYX_PUBLIC_KEY environment variable) to be set, and only allowing unsigned webhooks via an explicit skipSignatureVerification: true flag intended solely for local development (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated network attacker to send arbitrary HTTP POST requests to the voice-call webhook endpoint that are processed as legitimate Telnyx call events, resulting in high integrity impact with no confidentiality or availability impact per the CVSS scoring. This enables manipulation of call control logic, potential call fraud, unauthorized triggering of call-related AI agent actions, and service disruption for voice call functionality. Exploitation is limited to deployments where the Voice Call plugin is installed and enabled, and the webhook endpoint is publicly reachable (e.g., exposed via ngrok or a reverse proxy) (GitHub Advisory, OpenClaw Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.028% (0.047% per GitHub Advisory), placing it in the 15th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have network access to the exposed webhook endpoint, which limits the attack surface to misconfigured or intentionally public-facing deployments (GitHub Advisory, Feedly).

1. Reconnaissance: Identify publicly exposed OpenClaw instances with the voice-call plugin enabled using internet scanning tools (e.g., Shodan, Censys) or by probing known tunnel/proxy URLs (e.g., ngrok subdomains) for the voice-call webhook endpoint path.
2. Identify the webhook endpoint: Locate the Telnyx webhook handler URL, typically something like https://<host>/voice/webhook or a similar path configured in the OpenClaw voice-call plugin.
3. Craft a forged Telnyx event: Construct a JSON payload mimicking a legitimate Telnyx call event, such as {"event_type": "call.initiated", "payload": {"call_control_id": "<value>"}}, without any telnyx-signature-ed25519 or telnyx-timestamp headers.
4. Send the unauthenticated POST request: Submit the crafted payload via HTTP POST to the webhook endpoint. On vulnerable instances (where telnyx.publicKey is not configured), TelnyxProvider.verifyWebhook() returns ok: true without performing any signature check.
5. Trigger call control actions: The forged event is processed as a legitimate Telnyx event, allowing the attacker to manipulate call flows, trigger AI agent responses, or cause fraudulent call-related actions (GitHub Advisory, Patch Commit).

• Network: Unexpected HTTP POST requests to the voice-call webhook endpoint (e.g., /voice/webhook) originating from IP addresses not belonging to Telnyx's published IP ranges; requests lacking telnyx-signature-ed25519 and telnyx-timestamp headers.
• Logs: Application logs showing webhook events processed without signature verification warnings; absence of Ed25519 verification log entries for inbound webhook calls; log entries from [telnyx] Webhook verification skipped on production systems.
• Process/Application: Unexpected call control actions or AI agent behaviors triggered without corresponding legitimate Telnyx call activity; unusual call event sequences in voice-call plugin logs.
• Configuration: OpenClaw deployments running versions ≤ 2026.2.13 with the voice-call plugin enabled and no telnyx.publicKey or TELNYX_PUBLIC_KEY configured, with the webhook endpoint publicly reachable (GitHub Advisory).

Upgrade OpenClaw to version 2026.2.14 or later, which makes webhook verification fail closed by default and requires telnyx.publicKey to be configured (OpenClaw Release). As an immediate workaround on vulnerable versions, configure plugins.entries.voice-call.config.telnyx.publicKey (or set the TELNYX_PUBLIC_KEY environment variable) with the Ed25519 public key from the Telnyx Mission Control Portal to enforce signature verification. Additionally, restrict network access to the voice-call webhook endpoint to only Telnyx's published server IP ranges and avoid unnecessary public exposure via tunnels or proxies (GitHub Advisory, OpenClaw Advisory).

The vulnerability was reported by security researcher @p80n-sec and was part of a broader set of over 60 security fixes included in OpenClaw 2026.2.14, which received coverage from Infosecurity Magazine and BeyondMachines (Infosecurity Magazine, BeyondMachines). Endor Labs published a technical analysis tracing data flows to uncover six OpenClaw vulnerabilities including this one (Endor Labs). Community discussion also noted broader OpenClaw security concerns, including a report that approximately 40,000 OpenClaw instances were publicly exposed (ClawMoat Blog).