CVE-2026-26319

{
  "id": "CVE-2026-26319",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-26319",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-20T15:32:05.695747Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "openclaw",
          "product": "openclaw",
          "versions": [
            {
              "status": "affected",
              "version": "< 2026.2.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-19T23:16:24.857",
  "references": [
    {
      "url": "https://github.com/openclaw/openclaw/commit/29b587e73cbdc941caec573facd16e87d52f007b",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openclaw/openclaw/commit/f47584fec86d6d73f2d483043a2ad0e7e3c50411",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-4hg8-92x6-h2f3",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbound webhook requests when telnyx.publicKey is not configured, enabling unauthenticated callers to forge Telnyx events. Telnyx webhooks are expected to be authenticated via Ed25519 signature verification. In affected versions, TelnyxProvider.verifyWebhook() could effectively fail open when no Telnyx public key was configured, allowing arbitrary HTTP POST requests to the voice-call webhook endpoint to be treated as legitimate Telnyx events. This only impacts deployments where the Voice Call plugin is installed, enabled, and the webhook endpoint is reachable from the attacker (for example, publicly exposed via a tunnel/proxy). The issue has been fixed in version 2026.2.14."
    },
    {
      "lang": "es",
      "value": "OpenClaw es un asistente personal de IA. Las versiones 2026.2.13 e inferiores permiten que el plugin opcional @openclaw/voice-call, gestor de webhooks de Telnyx, acepte solicitudes de webhook entrantes sin firmar cuando telnyx.publicKey no está configurado, lo que permite a los llamantes no autenticados falsificar eventos de Telnyx. Se espera que los webhooks de Telnyx sean autenticados mediante verificación de firma Ed25519. En las versiones afectadas, TelnyxProvider.verifyWebhook() podría fallar de forma abierta (fail open) cuando no se configuró ninguna clave pública de Telnyx, permitiendo que solicitudes HTTP POST arbitrarias al endpoint del webhook de voice-call sean tratadas como eventos legítimos de Telnyx. Esto solo afecta a las implementaciones donde el plugin de Voice Call está instalado, habilitado y el endpoint del webhook es accesible desde el atacante (por ejemplo, expuesto públicamente a través de un túnel/proxy). El problema ha sido solucionado en la versión 2026.2.14."
    }
  ],
  "lastModified": "2026-06-17T10:26:05.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F3079A3-9FBD-4E87-821D-5CAF0622C555",
              "versionEndExcluding": "2026.2.14"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}