p PatchFirst

CVE-2026-28450

CVE-2026-28450 · OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote attackers can exploit these endpoints to read sensitive profile data, modify Nostr profiles, persist malicious changes to gateway configuration, and publish signed Nostr events using the bot's private key when the gateway HTTP port is accessible beyond localhost.

CVSS 8.3 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.2.12: Affected (custom)

    Update to 2026.2.12

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.2.12

    Update to 2026.2.12

Original sources

Check your server →