Summary
OpenClaw voice calls may launch an agent without preserving the caller's identity or non-owner status, allowing owner-only tool restrictions to fail open. A remote caller admitted by the configured inbound-call policy could therefore use tools intended for the trusted owner, depending on the deployment's agent configuration.
Affected context
The vulnerability occurs in deployments that enable classic inbound voice calling through the affected @openclaw/voice-call package and configure an agent with owner-only tool restrictions. It is most relevant when inbound callers are admitted through an open, pairing, or allowlist policy but the resulting agent session does not retain the caller's authorization context.
Exploit preconditions
- Attack surface: Inbound classic voice-call handling
- Required access: A caller must satisfy the deployment's configured inbound-call admission policy
- Trigger point: Agent launch for an admitted inbound call
- Why exploitation is possible: The caller's identity and non-owner status are not propagated, so owner-only tool filtering may fail open and expose the agent's normal tool authority
Why this happens
The underlying bug is an authorization-context propagation failure. The voice call handler launches the configured agent without carrying forward whether the caller is the trusted owner or an untrusted participant. As a result, downstream owner-only authorization checks may evaluate the session as if it were trusted. This maps to CWE-862, Missing Authorization, because access control is not reliably enforced before sensitive agent capabilities are made available.
Potential impact
- A remote caller may access tools intended only for the owner
- The agent could read sensitive data or connected service resources
- The caller could modify files or other application state
- The agent may execute commands according to its configured authority
- Connected services or operational workflows could be manipulated
General mitigation guidance
Mitigation generally focuses on preserving caller identity and enforcing
authorization at every tool boundary.
Common defensive patterns include:
- Propagating authenticated caller identity and trust level through the entire call-to-agent lifecycle
- Applying deny-by-default authorization for sensitive tools
- Enforcing owner-only checks independently at tool invocation time rather than relying only on session setup
- Using explicit allowlists for inbound callers and sensitive capabilities
- Limiting the agent's filesystem, command, and connected-service privileges
- Separating untrusted caller sessions from owner-controlled agent sessions
- Requiring confirmation or stronger authentication for high-impact actions
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis that traces caller identity and authorization state from call handlers into agent and tool execution paths
- Code review checks for agent launches that omit principal, role, or trust metadata
- Tests covering owner, non-owner, unauthenticated, paired, and allowlisted callers
- Policy enforcement requiring deny-by-default behavior for sensitive tools
- Runtime audit logs that record caller identity, authorization decisions, and invoked tools
- Automated security review tools that flag authorization checks performed only during session initialization
