PT-2026-38234 · Openclaw · Openclaw

Peng Zhou · Published 2026-05-06 · Updated 2026-05-07 · CVE-2026-43579

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description Insufficient access control in the Nostr plugin HTTP profile routes allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.

Recommendations Update to version 2026.4.10.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-43579

Affected Products

Openclaw

References · 6

• https://github.com/openclaw/openclaw/commit/6517c700de9bb0ee11b41ab625ef3b63d01b6083 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-f3h5-h452-vp3j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43579 · Security Note
• https://twitter.com/VulmonFeeds/status/2052169205005373761 · Twitter Post
• https://vulncheck.com/advisories/openclaw-insufficient-access-control-in-nostr-profile-mutation-routes · Note
• https://twitter.com/CVEnew/status/2052430118581100798 · Twitter Post