CVE-2026-100590

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1

Description An authorization bypass exists in the /voice set endpoint. This allows senders from external channels who are not owners to persist Gateway voice configuration. Attackers with command access can modify the voice used by Talk responses for the configured provider, which compromises configuration integrity. This issue does not expose credentials or grant additional host capabilities.

Recommendations Update to version 2026.7.1 or later. As a temporary mitigation, restrict access to the /voice set command.