CVE-2026-41385

MEDIUM

OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass

Title source: cna

Description

OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.

References (3)

[Vendor Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-jjw7-3vjf-fg5j

[Patch] https://github.com/openclaw/openclaw/commit/57700d716f660591fb6e09727f3ca8041fa48b9d

View Patch ZIP pw:eip

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-nostr-private-key-exposure-via-config-get-redaction-bypass

Scores

CVSS v3 6.5

EPSS 0.0002

EPSS Percentile 5.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-312

Status published

Products (2)

OpenClaw/OpenClaw < 2026.3.31

OpenClaw/OpenClaw 2026.3.31

Published Apr 28, 2026

Tracked Since Apr 29, 2026