Missing Authentication for Critical Function in OpenClaw - CVE-2026-29606
Published: May 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to send forged webhook requests that trigger unauthorized webhook event handling and cause a denial of service.
The vulnerability exists due to missing authentication for Twilio voice-call webhook signature verification in the voice-call webhook endpoint when handling webhook requests with ngrok loopback compatibility enabled. A remote attacker can send a specially crafted webhook request without a valid signature to send forged webhook requests that trigger unauthorized webhook event handling and cause a denial of service.
The issue only affects deployments where the optional voice-call extension is enabled, the webhook endpoint is reachable, and tunnel.allowNgrokFreeTierLoopbackBypass is explicitly enabled.