CVE-2026-28446 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.1 with voice-call extension contains an authentication bypass caused by improper inbound allowlist policy validation accepting empty caller IDs and suffix-based matching, letting remote attackers bypass access controls and execute tools.

Severity & Score

Impact

Remote attackers can bypass inbound access controls to reach voice-call agents and execute tools, potentially compromising system integrity.

Mitigation

Update to version 2026.2.1 or later.

References

• https://github.com/openclaw/openclaw/commit/f8dfd034f5d9235c5485f492a9e4ccc114e97fdb
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4rj2-gpmh-qq5x
• https://www.vulncheck.com/advisories/openclaw-inbound-allowlist-policy-bypass-in-voice-call-extension-via-empty-caller-id

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🔴 CVE-2026-28446 - Critical (9.8) OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist policy validation that accepts empty caller IDs and uses suffix-based matching instead of s... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28446/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner