PT-2026-33868 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-07 · Updated 2026-04-21 · CVE-2026-41301

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.3.22 through 2026.3.30

Description A signature verification bypass exists in the Nostr DM ingress path, allowing pairing challenges to be issued before event signature validation. An unauthenticated remote attacker can send forged direct messages to create pending pairing entries and trigger pairing-reply attempts. This can lead to the consumption of shared pairing capacity and trigger bounded relay and logging work on the Nostr channel. This issue does not grant message decryption, pairing approval, or broader authorization bypass.

Recommendations Update to version 2026.3.31 or later.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-41301

GHSA-H43V-27WG-5MF9

Affected Products

Openclaw

References · 7

• https://github.com/openclaw/openclaw/security/advisories/GHSA-h43v-27wg-5mf9 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/4ee742174f36b5445703e3b1ef2fbd6ae6700fa4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41301 · Security Note
• https://osv.dev/vulnerability/GHSA-h43v-27wg-5mf9 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2046571877813088275 · Twitter Post
• https://vulncheck.com/advisories/openclaw-forged-nostr-dm-pairing-state-creation-via-signature-verification-bypass · Note