CVE-2026-100544 in voice-call
Summary
by MITRE • 09/26/2026
openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller. A caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) on a deployment with inbound calling enabled can therefore drive tools intended for the trusted owner, potentially reading data, modifying files, executing commands, or controlling connected services depending on the agent's configuration. The issue is fixed in 2026.8.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within openclaw's @openclaw/voice-call package prior to version 2026.8.1 represents a critical authentication and authorization failure that undermines the security boundary between trusted owners and remote callers in voice-enabled AI agent deployments. The core technical flaw lies in the mechanism used to initialize agents for classic inbound voice calls, which fails to propagate essential identity attributes from the incoming call context into the agent's runtime environment. Specifically, when an inbound call is established based on a configured policy such as open access, pairing requirements, or allowlist verification, the system correctly admits the caller but neglects to signal whether that caller is the designated owner of the device or service. This omission results in the agent operating under default assumptions where it treats all admitted callers with equal privilege levels, effectively bypassing any logic designed to restrict tool execution to the owner only.
This architectural oversight leads directly to a failure in access control enforcement, categorized technically as CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if identity is assumed by default rather than verified. The operational impact is severe because it allows any remote caller who satisfies the basic inbound call policy requirements to execute tools that are strictly intended for authorized owners. These tools often possess high-level privileges, including the ability to read sensitive data stored on the device, modify system files, execute arbitrary commands within the host environment, or interact with connected third-party services and APIs. Consequently, an attacker can leverage this misconfiguration to perform actions ranging from information disclosure to full remote code execution, depending entirely on the specific configuration of the agent and the permissions granted to its available toolset.
The vulnerability aligns closely with MITRE ATT&CK techniques related to privilege escalation and lateral movement within IoT or voice assistant ecosystems, specifically T1078 Valid Accounts if the caller exploits valid but insufficiently restricted credentials, or more broadly under unauthorized access patterns where identity verification is incomplete. The lack of proper context propagation means that security controls relying on user role differentiation are rendered ineffective during voice interactions. This creates a significant attack surface for malicious actors targeting smart home devices, customer service bots, or any application utilizing this package to handle incoming voice commands without robust identity isolation between administrative and guest modes.
To mitigate this risk, organizations must immediately upgrade the @openclaw/voice-call package to version 2026.8.1 or later, where the issue has been resolved by ensuring that caller identity and non-owner status are correctly propagated during agent initialization for inbound calls. In environments where upgrading is not immediately feasible, temporary mitigations should include disabling classic inbound voice calling entirely if it is not strictly required, thereby removing the attack vector at the network level. Additionally, administrators should review their inbound call policies to ensure that even open or pairing-based access does not grant excessive tool permissions by default, implementing a principle of least privilege for all non-owner callers until the patch can be applied. Regular auditing of agent configurations and strict separation of administrative versus guest capabilities are essential practices to prevent similar identity propagation failures in future deployments.