CVE-2026-43579
OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.
| CWE | CWE-862 |
| Vendor | openclaw |
| Product | openclaw |
| Published | May 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw
Be the first to know when new medium vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
OpenClaw / OpenClaw
0 < 2026.4.10
References
github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-f3h5-h452-vp3j github.com: https://github.com/openclaw/openclaw/commit/6517c700de9bb0ee11b41ab625ef3b63d01b6083 vulncheck.com: https://www.vulncheck.com/advisories/openclaw-insufficient-access-control-in-nostr-profile-mutation-routes
Credits
🔍 Peng Zhou (@zpbrent)