p PatchFirst

CVE-2026-28450

CVE-2026-28450 · OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote attackers can exploit these endpoints to read sensitive profile data, modify Nostr profiles, persist malicious changes to gateway configuration, and publish signed Nostr events using the bot's private key when the gateway HTTP port is accessible beyond localhost.

CVSS 8.3 · Alta · EPSS 0,4% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • openclaw

    Versiones
    • ≥ 0, < 2026.2.12: Afectada (custom)

    Actualiza a 2026.2.12

  • openclaw npm

    Intervalos de versiones afectados
    • SEMVER: < 2026.2.12

    Actualiza a 2026.2.12

Fuentes originales

Comprueba tu servidor →