CVE-2026-26319: OpenClaw Package Suffers from Missing Webhook Authentication in Telnyx Provider
Summary
CVE-2026-26319: OpenClaw is Missing Webhook Authentication in Telnyx Provider Allows Unauthenticated Requests. Affects openclaw versions < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source framework designed for building voice call applications. It offers various plugins, including the '@openclaw/voice-call' plugin, which integrates with Telnyx for handling voice calls. The framework allows developers to create robust communication solutions but has a critical vulnerability that affects its webhook authentication mechanism.
Vulnerability Detail
The vulnerability arises from the Telnyx webhook handler in the OpenClaw framework, which can accept unsigned inbound webhook requests if the 'telnyx.publicKey' is not configured. This flaw allows unauthenticated callers to forge Telnyx events, potentially leading to unauthorized actions within the application. The issue is particularly concerning for deployments where the Voice Call plugin is installed, enabled, and the webhook endpoint is publicly accessible. The lack of proper signature verification can result in significant security risks, including data manipulation and unauthorized access.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, you can implement a temporary workaround by configuring the 'plugins.entries.voice-call.config.telnyx.publicKey' (or 'TELNYX_PUBLIC_KEY') to enable signature verification. For local development only, you may set 'skipSignatureVerification: true', but this should not be used in production environments. Example configuration:
plugins: { entries: { voice-call: { config: { telnyx: { publicKey: 'YOUR_TELNYX_PUBLIC_KEY', skipSignatureVerification: false
}
}
}
}
}
Conclusion
The OpenClaw framework has a significant vulnerability related to webhook authentication in the Telnyx provider, which can lead to unauthorized access and manipulation of voice call events. It is crucial to update to the patched version or implement workarounds to mitigate risks. Regular monitoring using tools like Vulert can help maintain the security of your application.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows unauthenticated requests to be processed as legitimate Telnyx events due to missing webhook authentication.
Versions of OpenClaw up to and including 2026.2.13 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can temporarily enable signature verification by configuring the Telnyx public key or using the 'skipSignatureVerification' option for local development only.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
