OpenClaw Telnyx provider accepts unauthenticated webhook requests (CVE-2026-26319)
OpenClaw's Telnyx webhook handler in its voice-call plugin accepted unauthenticated requests when the public key was not configured, potentially allowing attackers to forge webhook events. The vulnerability was fixed by making signature verification mandatory by default.
What happened
OpenClaw's @openclaw/voice-call plugin included a Telnyx webhook handler that could accept unsigned inbound webhook requests when telnyx.publicKey was not configured, allowing unauthenticated callers to forge Telnyx events.
The issue affected OpenClaw versions <= 2026.2.13 and only impacted deployments where the Voice Call plugin was installed, enabled, and the webhook endpoint was reachable from the attacker (for example, publicly exposed via a tunnel/proxy).
Reported impact
Arbitrary HTTP POST requests to the voice-call webhook endpoint could be treated as legitimate Telnyx events when the Telnyx public key was not configured.
Index analysis
Telnyx webhooks are expected to be authenticated via Ed25519 signature verification. TelnyxProvider.verifyWebhook() could effectively fail open when no Telnyx public key was configured.
Governance controls
The fix makes Telnyx webhook verification fail closed by default and requires telnyx.publicKey to be configured. A signature verification bypass exists only for local development via skipSignatureVerification: true, which is off by default and emits a loud startup warning.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.