CVE-2026-100544

Name of the Vulnerable Software and Affected Versions @openclaw/voice-call versions prior to 2026.8.1

Description The package launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. This causes owner-only tool filtering to fail open, exposing the agent's normal tool authority to remote callers admitted via the inbound-call policy (open, pairing, or allowlist). An attacker can potentially execute commands, modify files, read data, or control connected services by utilizing tools intended only for the trusted owner.

Recommendations Update @openclaw/voice-call to version 2026.8.1.