The vulnerability resides in the openclaw @openclaw/voice-call package prior to 2026.8.1. In its default configuration it launches an agent for classic inbound voice calls without propagating the caller's identity or designating the caller as a non‑owner. Consequently, owner‑only tool filtering can be bypassed and the calling party gains the full tool authority of the agent. A attacker who is accepted by the configured inbound‑call policy—whether open, pairing, or allowlist—can use that privilege to read protected data, modify files, execute arbitrary commands, or control other services tied to the agent’s configuration.

Systems running openclaw Voice Call before release 2026.8.1 and with inbound calling enabled are vulnerable. The issue applies to all deployments using the default inbound‑call policy settings, regardless of additional configuration unless the attacker already has policy access. No explicit version ranges are listed beyond the pre‑2026.8.1 threshold.

The CVSS score of 8.7 indicates a high severity flaw, but the EPSS score is not available, so the real‑world exploitation probability cannot be quantified from the public data. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote inbound voice call that satisfies the platform’s inbound‑call policy. An attacker only needs to reach the Voice Call agent via the network and submit a call that passes the policy to trigger the bypass. Once the bypass occurs the attacker can exploit the agent’s tool set according to the configuration, potentially causing data exposure, modification, or execution of commands.