OpenClaw: Nostr profile mutation routes allowed operator.write config persistence

MEDIUM 6.5CVE-2026-43579 · GHSA-f3h5-h452-vp3j · Published 06/05/2026 · updated 17/06/2026

In short

CVE-2026-43579 is a MEDIUM (CVSS 6.5) vulnerability affecting openclaw (openclaw), openclaw.
Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 12.3% of all vulnerabilities.
Fix: update to 2026.4.10 or later.

Package	Affected versions	Patched versions
openclaw openclaw	`< 2026.4.10`	`2026.4.10`
openclaw npm	`< 2026.4.10`	`2026.4.10`

Description

Summary

Nostr profile mutation routes allowed operator.write config persistence.

Affected Packages / Versions

Package: openclaw
Ecosystem: npm
Affected versions: < 2026.4.10
Patched versions: >= 2026.4.10

Impact

Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin authority.

Technical Details

The fix requires operator.admin scope for Nostr profile mutation routes.

Fix

The issue was fixed in #63553. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.

Fix Commit(s)

6517c700de9bb0ee11b41ab625ef3b63d01b6083
PR: #63553

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

NVD description

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.

References

openclaw/openclaw security advisory · WEB
openclaw/openclaw#63553 · WEB
openclaw/openclaw · PACKAGE
openclaw/openclaw commit 6517c70 · Patch
vulncheck.com/advisories/openclaw-insufficient-access-control-in-nostr-profile-mutation-routes · Third Party Advisory

More vulnerabilities in openclaw

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openclaw

< 2026.4.10

2026.4.10

openclaw

npm

< 2026.4.10

2026.4.10

Description

Summary

Nostr profile mutation routes allowed operator.write config persistence.

Affected Packages / Versions

Package: openclaw
Ecosystem: npm
Affected versions: < 2026.4.10
Patched versions: >= 2026.4.10

Impact

Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin authority.

Technical Details

The fix requires operator.admin scope for Nostr profile mutation routes.

Fix

The issue was fixed in #63553. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.

Fix Commit(s)

6517c700de9bb0ee11b41ab625ef3b63d01b6083
PR: #63553

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

NVD description

More vulnerabilities in openclaw

See all →