Frontier models can vanish overnight. Control is the new frontier in security AI.See why→

CVE-2026-28446

Discovered by AISLEPUBLISHEDIncorrect Implementation of Authentication Algorithm

Description

OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist policy validation that accepts empty caller IDs and uses suffix-based matching instead of strict equality. Remote attackers can bypass inbound access controls by placing calls with missing caller IDs or numbers ending with allowlisted digits to reach the voice-call agent and execute tools.

CVSS Base Scores

CVSS v4.09.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS v3.1
9.4

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected Products

VendorProductVersionStatus
OpenClawOpenClaw0affected

Credits

  • Petr Simecek (@simecek)(reporter)
  • @MegaManSec (https://joshua.hu) of AISLE Research Team(reporter)
  • Stanislav Fort, Aisle Research, www.aisle.com(analyst)

References