Medium severity6.8NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026
CVE-2026-28450
CVE-2026-28450
Description
OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote attackers can exploit these endpoints to read sensitive profile data, modify Nostr profiles, persist malicious changes to gateway configuration, and publish signed Nostr events using the bot's private key when the gateway HTTP port is accessible beyond localhost.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.12 | 2026.2.12 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/openclaw/openclaw/commit/647d929c9d0fd114249230d939a5cb3b36dc70e7nvdPatchWEB
- github.com/advisories/GHSA-mv9j-6xhh-g383ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-mv9j-6xhh-g383nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-28450ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-unauthenticated-profile-tampering-via-nostr-plugin-http-endpointsnvdThird Party AdvisoryWEB
- github.com/openclaw/openclaw/releases/tag/v2026.2.12ghsaWEB
News mentions
0No linked articles in our index yet.