CVE-2026-26319
Published: 19 February 2026
Summary
CVE-2026-26319 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Openclaw Openclaw. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and IA-9 (Service Identification and Authentication).
Deeper analysis
CVE-2026-26319 affects OpenClaw, a personal AI assistant, in versions 2026.2.13 and below. The vulnerability resides in the optional @openclaw/voice-call plugin's Telnyx webhook handler, which accepts unsigned inbound webhook requests when the telnyx.publicKey is not configured. This bypasses the expected Ed25519 signature verification for Telnyx webhooks, causing the TelnyxProvider.verifyWebhook() function to fail open. As a result, arbitrary HTTP POST requests to the voice-call webhook endpoint are processed as legitimate Telnyx events. The issue is classified under CWE-306 (Missing Authentication for Critical Function) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Any unauthenticated attacker with network access to the voice-call webhook endpoint can exploit this vulnerability by sending forged HTTP POST requests mimicking Telnyx events. This requires the voice-call plugin to be installed and enabled, with the endpoint reachable, such as when publicly exposed via a tunnel or proxy. Successful exploitation allows attackers to impersonate Telnyx and trigger plugin actions as legitimate events, leading to high integrity impacts without affecting confidentiality or availability.
Mitigation is available in OpenClaw version 2026.2.14, which addresses the issue through fixes detailed in GitHub commits 29b587e73cbdc941caec573facd16e87d52f007b and f47584fec86d6d73f2d483043a2ad0e7e3c50411. The security advisory GHSA-4hg8-92x6-h2f3 and release notes for v2026.2.14 provide further details. Deployments should update to the patched version and ensure telnyx.publicKey is configured where applicable.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8434
Vulnerability details
OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbound webhook requests when telnyx.publicKey is not configured, enabling unauthenticated callers to forge Telnyx events. Telnyx webhooks are expected…
more
to be authenticated via Ed25519 signature verification. In affected versions, TelnyxProvider.verifyWebhook() could effectively fail open when no Telnyx public key was configured, allowing arbitrary HTTP POST requests to the voice-call webhook endpoint to be treated as legitimate Telnyx events. This only impacts deployments where the Voice Call plugin is installed, enabled, and the webhook endpoint is reachable from the attacker (for example, publicly exposed via a tunnel/proxy). The issue has been fixed in version 2026.2.14.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Auth bypass on publicly reachable webhook endpoint (fail-open signature verification) directly enables exploitation of a public-facing application to trigger unauthorized actions.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates authentication of external service providers like Telnyx prior to processing webhook requests, directly preventing forged unauthenticated events.
Requires the webhook verification function to fail to a secure state when signature validation fails due to missing public key configuration, blocking fail-open exploitation.
Prohibits processing of critical functions like webhook events without identification or authentication unless explicitly authorized, addressing the acceptance of unsigned requests.