요약
- CVE-2026-35627은(는) openclaw (openclaw), openclaw에 영향을 주는 높음 (CVSS 8.2) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.45%, 전체 취약점의 39.5%보다 높음.
- 조치: 2026.3.22 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.22
| 2026.3.22
|
| openclaw npm | < 2026.3.22
| 2026.3.22
|
Description
Summary
Nostr inbound DM handling could perform crypto and dispatch work before sender and pairing policy enforcement, enabling unauthorized pre-auth computation.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
- Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
1ee9611079e81b9122f4bed01abb3d9f56206c77
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- extensions/nostr/src/channel.ts now performs authorization before decrypting and dispatching inbound DM content.
- extensions/nostr/src/nostr-bus.ts adds pre-crypto authorization, size, and rate guardrails before expensive decrypt work.
OpenClaw thanks @kuranikaran for reporting.
NVD description
OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigger unauthorized pre-authentication computation by sending crafted DM messages, enabling denial of service through resource exhaustion.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free