PT-2026-38234

CVE-2026-43579

Published

2026-04-17

Updated

2026-05-07

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description Insufficient access control in the Nostr plugin HTTP profile routes allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.

Recommendations Update to version 2026.4.10.

Exploitability

Exploit

Fix

Impacts

Researchers

Peng Zhou

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

CWE-266: Incorrect Privilege Assignment