CVE-2026-29606 Details
Description
OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly reachable webhook endpoint without a valid X-Twilio-Signature header, resulting in unauthorized webhook event handling and potential request flooding attacks.
A webhook signature verification bypass vulnerability has been identified in the OpenClaw voice-call extension, affecting versions prior to 2026.2.14. When the 'tunnel.allowNgrokFreeTierLoopbackBypass' option is enabled, this vulnerability allows unauthenticated requests to bypass signature verification on the webhook endpoint. An external attacker can exploit this by sending forged requests without a valid 'X-Twilio-Signature' header, leading to unauthorized handling of webhook events and potential flooding of requests.
Users can update to OpenClaw version 2026.2.14 or later, where this vulnerability has been patched. In the patched version, the 'allowNgrokFreeTierLoopbackBypass' option no longer bypasses signature verification and only allows trusting forwarded headers on loopback to reconstruct the public ngrok URL for proper signature validation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.2.14 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | CVE Modified | [email protected] |
| Mar 5, 2026 | CVE Modified | [email protected] |
| Mar 5, 2026 | New CVE Received | [email protected] |