Unauthorized Crypto Work in OpenClaw: Nostr DM Vulnerability
Summary
GHSA-2j53-2c28-g9v2: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-65h8-27jh-q8wv. Affects openclaw versions < 2026.3.22. Fixed in 2026.3.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an open-source library designed for handling Nostr protocol communications, particularly focusing on direct messaging functionalities. It allows users to send and receive messages securely while enforcing sender policies. However, prior to version 2026.3.22, OpenClaw had a vulnerability that allowed attackers to exploit the system by sending crafted direct messages, leading to unauthorized cryptographic operations.
Vulnerability Detail
The vulnerability in OpenClaw arises from its failure to enforce sender and pairing policy validation before performing cryptographic and dispatch operations on inbound Nostr direct messages. This oversight allows attackers to send specially crafted DM messages that trigger unauthorized pre-authentication computations. The potential ramifications include denial of service through resource exhaustion, as the system could be overwhelmed by excessive cryptographic computations initiated by malicious actors.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.3.22
This is the first release that contains the fix.
npm install openclaw@2026.3.22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned to mitigate this vulnerability other than updating to the patched version. However, users can monitor their systems for unusual activity or limit the sources of incoming messages as a temporary measure.
Conclusion
In summary, the vulnerability in OpenClaw allows unauthorized cryptographic operations through crafted direct messages, posing a risk of denial of service. Users are advised to update to the latest version to mitigate this risk effectively. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
Failing to address this vulnerability may lead to denial of service attacks, where attackers can exhaust system resources, causing disruptions in service.
Yes, you should upgrade to OpenClaw version 2026.3.22 or later to ensure that the vulnerability is patched.
If you cannot update immediately, consider monitoring your application for unusual activity and limit incoming messages as a temporary measure until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
