Is CVE-2026-26319 actively exploited?

No active exploitation of CVE-2026-26319 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26319 be exploited remotely?

Yes. CVE-2026-26319 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26319?

CVE-2026-26319 has a CVSS score of 7.5 (HIGH) and an EPSS exploitation probability of 0.04%.

HOME VULNERABILITIESCVE-2026-26319

HIGH

CVE-2026-26319

CWE-306Published: February 19, 2026· Updated: Feb 20, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.0th

Official Description

OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbound webhook requests when telnyx.publicKey is not configured, enabling unauthenticated callers to forge Telnyx events. Telnyx webhooks are expected to be authenticated via Ed25519 signature verification. In affected versions, TelnyxProvider.verifyWebhook() could effectively fail open when no Telnyx public key was configured, allowing arbitrary HTTP POST requests to the voice-call webhook endpoint to be treated as legitimate Telnyx events. This only impacts deployments where the Voice Call plugin is installed, enabled, and the webhook endpoint is reachable from the attacker (for example, publicly exposed via a tunnel/proxy). The issue has been fixed in version 2026.2.14.

NVD Source

Technical Analysis

CVE-2026-26319 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.