CVE-2026-29606

Description: verifyTwilioWebhook() treats a loopback remoteAddress as evidence that a request is local and trusted. It is not. The ngrok agent forwards requests from the public webhook URL to the local server, so a request that originated anywhere on the internet arrives with a loopback source address:

const isNgrokFreeTier =
  verificationUrl.includes('.ngrok-free.app') || verificationUrl.includes('.ngrok.io');

if (isNgrokFreeTier && options?.allowNgrokFreeTierLoopbackBypass && isLoopbackAddress(ctx.remoteAddress)) {
  return { ok: true, reason: 'ngrok free tier compatibility mode (loopback only)' };
}

With allowNgrokFreeTierLoopbackBypass enabled, validateTwilioSignature() is skipped entirely. The control that was meant to narrow the bypass to local callers is the thing the proxy defeats. Affects openclaw before 2026.2.14.

Impact: Unauthenticated webhook processing whenever the ngrok compatibility mode is on.

The 6.3 recorded here is the CVSS v4.0 score published with the advisory; its v3.1 score is 6.5.