CVE-2026-28450

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.12

Description The OpenClaw Nostr channel plugin, when installed and enabled, exposes unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import. These endpoints allow reading and modifying Nostr profiles without gateway authentication. Attackers can exploit these endpoints to read sensitive profile data, modify Nostr profiles, persist malicious changes to gateway configuration, and publish signed Nostr events using the bot's private key if the gateway HTTP port is accessible beyond localhost. The issue is exploitable when the gateway HTTP port is reachable beyond localhost.

Recommendations Upgrade to OpenClaw version 2026.2.12 or later. As a temporary mitigation, restrict gateway HTTP exposure (bind loopback-only and/or enforce network-layer access controls) until upgraded.