OpenClaw versions up to and including 2026.2.13 expose the Telnyx webhook handler in the optional @openclaw/voice-call plugin to unsigned inbound requests when the telnyx.publicKey setting is not configured. The verification routine, TelnyxProvider.verifyWebhook(), can bypass signature validation entirely in this circumstance, allowing an attacker to send arbitrary HTTP POST traffic to the voice‑call endpoint and have it processed as a legitimate Telnyx event. This flaw represents a clear loss of authentication and is classified as CWE‑306.

The vulnerability is present in the OpenClaw OpenClaw product, specifically versions 2026.2.13 and earlier. The affected path requires that the Voice Call plugin is installed, enabled, and that the webhook endpoint is reachable from the network of an attacker. The fix was released in version 2026.2.14.

With a CVSS score of 7.5, the issue is considered high severity. The EPSS score is below 1%, indicating low current exploitation probability in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need external network access to the webhook endpoint—typically via a publicly exposed URL or tunnel—to exploit the flaw. The exploit path is straightforward: craft an HTTP POST directed at the endpoint, and, if the public key is absent, the request is accepted and processed as a legitimate Telnyx event.