p PatchFirst

CVE-2026-28446

CVE-2026-28446 · OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist policy validation that accepts empty caller IDs and uses suffix-based matching instead of strict equality. Remote attackers can bypass inbound access controls by placing calls with missing caller IDs or numbers ending with allowlisted digits to reach the voice-call agent and execute tools.

CVSS 9.2 · Crítica · EPSS 0,7% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • openclaw

    Versiones
    • ≥ 0, < 2026.2.1: Afectada (custom)

    Actualiza a 2026.2.1

  • openclaw npm

    Intervalos de versiones afectados
    • SEMVER: < 2026.2.2

    Actualiza a 2026.2.2

Fuentes originales

Comprueba tu servidor →