Threats affecting pkg:npm/@openclaw/voice-call

CVE-2026-100544 is a high-severity vulnerability in the openclaw voice-call package before version 2026.8.1. The flaw allows inbound callers admitted by the deployment's inbound-call policy to bypass authorization checks because the caller's identity and non-owner status are not propagated. This can cause owner-only tool filtering to fail, exposing the agent's normal tool authority to remote callers. Exploitation can lead to unauthorized reading of data, file modification, command execution, or control of connected services depending on the agent's configuration. The issue is fixed in version 2026.8.1.