NVD HIGH: CVE-2026-100544 — openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured ...
openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller. A caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) on a dep
CVE-2026-100544