CVE-2026-43579CWE-862

OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

Medium · published May 6, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00380 · 30.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-06T19:49Z
EPSS history
Timeline
  • 06 MAY 19:49Z
    OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes
    cvelistv5