CVE-2026-41385CWE-312

OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass

High · published April 28, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass
    cvelistv5