OpenClaw: Nostr profile mutation routes allowed operator.write config persistence

Summary

Nostr profile mutation routes allowed operator.write config persistence.

Affected Packages / Versions

• Package: openclaw
• Ecosystem: npm
• Affected versions: < 2026.4.10
• Patched versions: >= 2026.4.10

Impact

Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin authority.

Technical Details

The fix requires operator.admin scope for Nostr profile mutation routes.

Fix

The issue was fixed in #63553. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.

Fix Commit(s)

• 6517c700de9bb0ee11b41ab625ef3b63d01b6083
• PR: #63553

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.