CVE-2026-43579 json
OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes
published 2026-04-17 6 mo ago modified 2026-07-08 4 mo ago also GHSA-f3h5-h452-vp3j , EUVD-2026-28170
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.
Patch / fix
- npm openclaw 2026.4.10
- OpenClaw OpenClaw 2026.4.10
- github.com/openclaw/openclaw@6517c70 commit
- github.com/openclaw/openclaw#63553 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | openclaw | <2026.4.10 |
2026.4.10 |
Affected products
- OpenClaw OpenClaw
Classification
References
-
github.com
/openclaw/openclaw/commit/6517c700de9bb0ee11b41ab625ef3b63d01b6083
patch
-
github.com
/openclaw/openclaw/pull/63553
web
-
github.com
/openclaw/openclaw/security/advisories/GHSA-f3h5-h452-vp3j
vendor-advisory, web, mitigation
-
vulncheck.com
/advisories/openclaw-insufficient-access-control-in-nostr-profile-mutation-routes
third-party-advisory
-
github.com
/openclaw/openclaw
package
Sources
- CVE List CVE-2026-43579
- GitHub Advisory GHSA-f3h5-h452-vp3j
- NVD CVE-2026-43579
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.