Medium severity6.5NVD Advisory· Published May 6, 2026· Updated May 7, 2026
CVE-2026-43579
CVE-2026-43579
Description
OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/openclaw/openclaw/commit/6517c700de9bb0ee11b41ab625ef3b63d01b6083nvdPatch
- github.com/openclaw/openclaw/security/advisories/GHSA-f3h5-h452-vp3jnvdMitigationVendor Advisory
- www.vulncheck.com/advisories/openclaw-insufficient-access-control-in-nostr-profile-mutation-routesnvdThird Party Advisory
News mentions
0No linked articles in our index yet.