CVE-2026-41385
CVE-2026-41385 · OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-jjw7-3vjf-fg5j
- https://github.com/openclaw/openclaw/commit/57700d716f660591fb6e09727f3ca8041fa48b9d
- https://www.vulncheck.com/advisories/openclaw-nostr-private-key-exposure-via-config-get-redaction-bypass
- https://nvd.nist.gov/vuln/detail/CVE-2026-41385