https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 05:48:16 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-29606 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled.</p> <p>## Impact</p> <p>This issue is limited to configurations that explicitly enable and expose the voice-call webhook endpoint.</p> <p>Not affected by default: - The voice-call extension is optional and disabled by default. - The bypass only applied when `tunnel.allowNgrokFreeTierLoopbackBypass` was explicitly enabled. - Exploitation required the webhook to be reachable (typically via a public ngrok URL during development).</p> <p>Worst case (when exposed and the option was enabled): - An external attacker could send forged requests to the publicly reachable webhook endpoint that would be accepted without a valid `X-Twilio-Signature`. - This could result in unauthorized webhook event handling (integrity) and request flooding (availability).</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.13` (latest published as of 2026-02-14) - Patched versions: `&gt;= 2026.2.14` (planned next release; pending publish)</p> <p>## Fix</p> <p>`allowNgrokFreeTierLoopbackBypass` no longer bypasses signature verification. It only enables trusting forwarded headers on loopback so the public ngrok URL can be reconstructed for correct signature validation.</p> <p>Fix commit(s): - ff11d8793b90c52f8d84dae3fbb99307da51b5c9</p> <p>Thanks @p80n-sec for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled.</p> <p>## Impact</p> <p>This issue is limited to configurations that explicitly enable and expose the voice-call webhook endpoint.</p> <p>Not affected by default: - The voice-call extension is optional and disabled by default. - The bypass only applied when `tunnel.allowNgrokFreeTierLoopbackBypass` was explicitly enabled. - Exploitation required the webhook to be reachable (typically via a public ngrok URL during development).</p> <p>Worst case (when exposed and the option was enabled): - An external attacker could send forged requests to the publicly reachable webhook endpoint that would be accepted without a valid `X-Twilio-Signature`. - This could result in unauthorized webhook event handling (integrity) and request flooding (availability).</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.13` (latest published as of 2026-02-14) - Patched versions: `&gt;= 2026.2.14` (planned next release; pending publish)</p> <p>## Fix</p> <p>`allowNgrokFreeTierLoopbackBypass` no longer bypasses signature verification. It only enables trusting forwarded headers on loopback so the public ngrok URL can be reconstructed for correct signature validation.</p> <p>Fix commit(s): - ff11d8793b90c52f8d84dae3fbb99307da51b5c9</p> <p>Thanks @p80n-sec for reporting.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-29606 https://db.gcve.eu/vuln/cve-2026-29606 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly reachable webhook endpoint without a valid X-Twilio-Signature header, resulting in unauthorized webhook event handling and potential request flooding attacks.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly reachable webhook endpoint without a valid X-Twilio-Signature header, resulting in unauthorized webhook event handling and potential request flooding attacks.</p> https://db.gcve.eu/vuln/cve-2026-29606