Missing Authentication for Critical Function in OpenClaw - CVE-2026-29606

Detailed vulnerability description

The vulnerability allows a remote attacker to send forged webhook requests that trigger unauthorized webhook event handling and cause a denial of service.

The vulnerability exists due to missing authentication for Twilio voice-call webhook signature verification in the voice-call webhook endpoint when handling webhook requests with ngrok loopback compatibility enabled. A remote attacker can send a specially crafted webhook request without a valid signature to send forged webhook requests that trigger unauthorized webhook event handling and cause a denial of service.

The issue only affects deployments where the optional voice-call extension is enabled, the webhook endpoint is reachable, and tunnel.allowNgrokFreeTierLoopbackBypass is explicitly enabled.

How to mitigate CVE-2026-29606

Sources

• https://github.com/openclaw/openclaw/security/advisories/GHSA-c37p-4qqg-3p76
• https://github.com/openclaw/openclaw/commit/ff11d8793b90c52f8d84dae3fbb99307da51b5c9