CVE-2026-28446 is an authentication bypass in the optional voice-call extension of OpenClaw. The inbound allowlist accepted empty caller IDs and matched numbers by suffix instead of exact equality. NVD scores it 9.4. Upgrade openclaw to 2026.2.2 or later if you use the extension.
What's affected
The GitHub advisory GHSA-4rj2-gpmh-qq5x lists affected versions 2026.2.1 and earlier and patched versions 2026.2.2 and later of the npm package openclaw. NVD's description says prior to 2026.2.1, which is slightly different. Use 2026.2.2 as the target.
The flaw only matters if you installed and enabled the voice-call extension and set the inbound policy to allowlist or pairing. Deployments without the extension are not affected, per the advisory.
The advisory rates it Critical at 9.4 with network access, low complexity and no privileges. The weakness is CWE-303 (Incorrect Implementation of Authentication Algorithm).
How to check if you're exposed
Check the OpenClaw version in each project and global install.
npm ls openclaw
npm ls -g openclaw
Then check whether the voice-call extension is installed and enabled, and what inbound policy it uses. If it is not installed, the advisory says you are not affected.
What to do now
- Upgrade openclaw to 2026.2.2 or later.
- Reject inbound calls with a missing caller ID, which the fixed version now does.
- Keep allowlist entries as full numbers and expect exact matches only.
- Review which tools the voice-call agent can run, and reduce them to what callers genuinely need.
- Review call logs for calls from anonymous or unfamiliar numbers.
Why it matters
Two different shortcuts caused the bypass. An empty caller ID, once normalised, became an empty string, and the allowlist check treated that as a match. Suffix matching meant a number that ended with an allowlisted number was accepted, so a number with extra digits at the front passed.
Both are comparison bugs. The fix is strict equality on the full normalised number, plus a rule that rejects calls with no caller ID. Allowlists are only as good as the comparison behind them, and tests should include missing values and near matches.
Caller ID is also not strong authentication on its own, since it can be spoofed or withheld on many networks. Where a voice agent can run tools, a second factor such as a pairing step is a better design.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Am I affected without the voice-call extension?
No. The advisory says deployments that do not install or enable it are not affected.
What changed in the fix?
Inbound calls with a missing caller ID are rejected, and normalised caller IDs must match the allowlist exactly, with no prefix or suffix matching.
Sources
Last reviewed: 19 October 2026.
