Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Flaw in **Inbound Allowlist Policy Validation**. Specifically, it allows bypass via **Empty Caller ID** and **Suffix Matching** logic errors. (CWE not specified in data).

Q: Who is affected? (Versions/Components)

👥 **Affected**: **OpenClaw** (Open-source AI Assistant). 📦 **Versions**: All versions **before 2026.2.1**. 🏢 **Vendor**: OpenClaw.

Q: What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: Remote attackers can **bypass inbound access control**. ⚠️ **Impact**: High Confidentiality & Integrity impact (CVSS C:H, I:H), Low Availability impact (A:L).

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **LOW**. 🌐 **Network**: Remote (AV:N). 🔑 **Auth**: None required (PR:N). 👁️ **UI**: None required (UI:N). 🎯 **Complexity**: Low (AC:L).

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Public Exp?**: No specific PoC code provided in data. 📢 **Advisories**: VulnCheck and GitHub Security Advisory (GHSA-4rj2-gpmh-qq5x) confirm the flaw exists.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for **OpenClaw** installations. 📞 **Focus**: Check **voice-call extensions** for allowlist policy configurations. 🆚 **Version**: Verify if version is < 2026.2.1.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed?**: **YES**. 🛠️ **Patch**: Version **2026.2.1** and later. 📝 **Commit**: See GitHub commit f8dfd034f5d9235c5485f492a9e4ccc114e97fdb.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: Mitigate by restricting **inbound voice-call extensions**. 🚫 **Block**: Empty Caller IDs if possible. 🛑 **Isolate**: Limit network access to the service until patched.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 📈 **CVSS**: High severity (C:H, I:H). ⏳ **Action**: Patch immediately to 2026.2.1+ to prevent remote bypass attacks.

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: OpenClaw < 2026.2.1 has a critical **Inbound Allowlist Policy Bypass**. 📉 **Consequences**: Attackers can bypass access controls via voice-call extensions, leading to unauthorized remote access.

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: Flaw in **Inbound Allowlist Policy Validation**. Specifically, it allows bypass via **Empty Caller ID** and **Suffix Matching** logic errors. (CWE not specified in data).

Question 3

Who is affected? (Versions/Components)

Accepted Answer

👥 **Affected**: **OpenClaw** (Open-source AI Assistant). 📦 **Versions**: All versions **before 2026.2.1**. 🏢 **Vendor**: OpenClaw.

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

💀 **Attacker Actions**: Remote attackers can **bypass inbound access control**. ⚠️ **Impact**: High Confidentiality & Integrity impact (CVSS C:H, I:H), Low Availability impact (A:L).

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

🔓 **Threshold**: **LOW**. 🌐 **Network**: Remote (AV:N). 🔑 **Auth**: None required (PR:N). 👁️ **UI**: None required (UI:N). 🎯 **Complexity**: Low (AC:L).

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🧪 **Public Exp?**: No specific PoC code provided in data. 📢 **Advisories**: VulnCheck and GitHub Security Advisory (GHSA-4rj2-gpmh-qq5x) confirm the flaw exists.

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check**: Scan for **OpenClaw** installations. 📞 **Focus**: Check **voice-call extensions** for allowlist policy configurations. 🆚 **Version**: Verify if version is < 2026.2.1.

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Fixed?**: **YES**. 🛠️ **Patch**: Version **2026.2.1** and later. 📝 **Commit**: See GitHub commit f8dfd034f5d9235c5485f492a9e4ccc114e97fdb.

Question 9

What if no patch? (Workaround)

Accepted Answer

🚧 **No Patch?**: Mitigate by restricting **inbound voice-call extensions**. 🚫 **Block**: Empty Caller IDs if possible. 🛑 **Isolate**: Limit network access to the service until patched.

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔥 **Urgency**: **HIGH**. 📈 **CVSS**: High severity (C:H, I:H). ⏳ **Action**: Patch immediately to 2026.2.1+ to prevent remote bypass attacks.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-28446 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring