p PatchFirst

CVE-2026-43579

CVE-2026-43579 · OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.

CVSS 6.0 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.4.10: Affected (semver)
    • 2026.4.10: Not affected (semver)

    Update to 2026.4.10

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.4.10

    Update to 2026.4.10

Original sources

Check your server →