| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| openclaw | < 2026.4.10 | 2026.4.10 |
| openclaw | < 2026.4.10 | 2026.4.10 |
Nostr profile mutation routes allowed operator.write config persistence.
openclaw< 2026.4.10>= 2026.4.10Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin authority.
The fix requires operator.admin scope for Nostr profile mutation routes.
The issue was fixed in #63553. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.
6517c700de9bb0ee11b41ab625ef3b63d01b6083Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.
Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí