OpenClaw < 2026.2.14 - ngrok लूपबैक अनुकूलता के माध्यम से वेबहुक हस्ताक्षर सत्यापन बाईपास

The core of this vulnerability lies in the flawed signature verification process for webhooks in OpenClaw's voice-call extension. When the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled, an attacker can craft and send malicious requests to the publicly accessible webhook endpoint without providing a valid X-Twilio-Signature header. This bypass effectively allows the attacker to impersonate legitimate webhook requests, potentially triggering unintended actions within the OpenClaw system. The potential impact ranges from simple denial-of-service through request flooding to more severe consequences depending on the actions triggered by the forged webhook events, such as unauthorized data modification or system control.

OpenClaw deployments utilizing the voice-call extension and with the tunnel.allowNgrokFreeTierLoopbackBypass option enabled are at immediate risk. Organizations relying on OpenClaw for critical communication workflows, particularly those with publicly exposed webhook endpoints, should prioritize patching.

• nodejs: Monitor OpenClaw logs for requests lacking a valid X-Twilio-Signature header. Use grep to search for patterns like Signature verification failed or Invalid webhook request.

grep -i 'signature verification failed' /path/to/openclaw/logs/webhook.log

• generic web: Examine access logs for unusual webhook request patterns, such as a high volume of requests from a single IP address or requests with unexpected parameters. Use curl to test webhook endpoint security.

curl -H 'X-Twilio-Signature: invalid_signature' https://your-openclaw-instance/webhook

1. 2026-03-05Disclosure

   disclosure

1. आरक्षित2026-03-04
2. प्रकाशित2026-03-05
3. संशोधित2026-03-09
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-29606 is to upgrade OpenClaw to version 2026.2.14 or later, which contains the fix for the signature verification bypass. If an immediate upgrade is not feasible, disabling the tunnel.allowNgrokFreeTierLoopbackBypass option can significantly reduce the attack surface, although it may impact legitimate Ngrok functionality. Consider implementing a Web Application Firewall (WAF) with rules to validate the X-Twilio-Signature header and block requests lacking a valid signature. Monitor webhook logs for suspicious activity, such as unexpected event types or high request rates from unknown sources.