OpenClaw: Forged Nostr DMs could create pairing state before signature verification

TRUNG BÌNH 5.3CVE-2026-41301 · GHSA-h43v-27wg-5mf9 · Công bố 21/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-41301 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.25%, cao hơn 16.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.31 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.31`	`2026.3.31`
openclaw npm	`≥ 2026.3.22, < 2026.3.31`	`2026.3.31`

Mô tả

Summary

Before OpenClaw 2026.3.31, the Nostr DM ingress path could issue pairing challenges before validating the event signature. A forged DM could create a pending pairing entry and trigger a pairing-reply attempt before signature rejection.

Impact

An unauthenticated remote sender could consume shared pairing capacity and trigger bounded relay/logging work on the Nostr channel. This issue did not grant message decryption, pairing approval, or broader authorization bypass.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: >= 2026.3.22, < 2026.3.31
Patched versions: >= 2026.3.31
Latest published npm version: 2026.4.1

Fix Commit(s)

4ee742174f36b5445703e3b1ef2fbd6ae6700fa4 — verify inbound DM signatures before pairing replies

Release Process Note

The fix shipped in OpenClaw 2026.3.31 on March 31, 2026. The current published npm release 2026.4.1 from April 1, 2026 also contains the fix.

Thanks @smaeljaish771 for reporting.

Mô tả của NVD

OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges to be issued before event signature validation. An unauthenticated remote attacker can send forged direct messages to create pending pairing entries and trigger pairing-reply attempts, consuming shared pairing capacity and triggering bounded relay and logging work on the Nostr channel.