CVE-2026-108757 Overview
CVE-2026-108757 is a missing authentication vulnerability [CWE-306] in the Nexting pinclaw OpenClaw channel plugin through version 0.3.0. The flaw resides in src/core/http-router.ts, where the authToken check is skipped on the POST /pinclaw/send endpoint. The plugin listens on port 18790 and binds to all interfaces by default. Attackers on an adjacent network can reach the endpoint without credentials and inject blind prompts into the user's main OpenClaw agent session. These prompts are processed as user instructions, giving the attacker control over agent behavior.
Critical Impact
Unauthenticated attackers on adjacent networks can inject arbitrary prompts into a victim's OpenClaw AI agent session, enabling blind manipulation of agent actions and downstream integrations.
Affected Products
- Nexting pinclaw OpenClaw channel plugin versions through 0.3.0
- The pinclaw NPM package distributed via the npm registry
- OpenClaw agent sessions bound to 0.0.0.0:18790 by default
Discovery Timeline
- 2026-10-11 - CVE-2026-108757 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-108757
Vulnerability Analysis
The pinclaw plugin exposes an HTTP router that normally enforces an authToken header on sensitive routes. The POST /pinclaw/send handler omits this authentication check entirely. Any client capable of reaching the listening socket can submit a request body that is forwarded to the OpenClaw agent as a user-authored instruction.
Because the server binds to all interfaces on port 18790 by default, exposure extends beyond localhost to any host sharing the network segment. The weakness is categorized as [CWE-306] Missing Authentication for a Critical Function. Attackers do not need to observe responses; the injection is blind and still permits agent manipulation.
Root Cause
The root cause is an authorization gap in the HTTP routing logic within src/core/http-router.ts. The /pinclaw/send route is registered without invoking the shared authToken validation middleware applied to other endpoints. Combined with a default bind address that covers all interfaces, the plugin trusts any caller that can establish a TCP connection to the port.
Attack Vector
Exploitation requires network reachability to the victim host on port 18790. An attacker on the same Wi-Fi network, VPN, or adjacent subnet sends a crafted HTTP POST request to /pinclaw/send with a prompt payload. The pinclaw plugin forwards the payload to the OpenClaw agent, which treats it as a legitimate user instruction. The agent then executes actions, queries tools, or interacts with connected services under the victim's context. See the VulnCheck Advisory for Pinclaw and the HackMD Agent Injection Report for complete technical details.
Detection Methods for CVE-2026-108757
Indicators of Compromise
- Unexpected inbound TCP connections to port 18790 on workstations running the pinclaw plugin
- HTTP POST requests to the /pinclaw/send path originating from non-loopback source addresses
- OpenClaw agent transcripts containing instructions the user did not author
- Outbound agent-driven actions (tool calls, API requests) that do not correlate with user activity
Detection Strategies
- Inspect host firewall and endpoint telemetry for processes listening on 0.0.0.0:18790
- Review pinclaw and OpenClaw application logs for /pinclaw/send requests lacking a valid authToken header
- Correlate agent session activity with user-input events to flag instructions injected without a corresponding UI action
Monitoring Recommendations
- Alert on any remote source address connecting to port 18790 outside of 127.0.0.1
- Capture HTTP request headers and bodies on the pinclaw endpoint for forensic review
- Monitor npm package inventories for installed pinclaw versions at or below 0.3.0
How to Mitigate CVE-2026-108757
Immediate Actions Required
- Upgrade the pinclaw package to a release later than 0.3.0 once a patched version is published on the NPM Package: Pinclaw registry
- Restrict the pinclaw listener to 127.0.0.1 instead of 0.0.0.0 to eliminate adjacent-network exposure
- Block inbound traffic to TCP port 18790 at the host firewall on all non-loopback interfaces
- Audit OpenClaw agent sessions for suspicious or unauthorized instructions issued since deployment
Patch Information
No vendor patch URL is listed in the NVD record at the time of publication. Monitor the GitHub HTTP Router Code and the GitHub Server Code Snippet for upstream fixes that add authToken validation to the /pinclaw/send route.
Workarounds
- Reconfigure the plugin to bind only to the loopback interface until a patched release is available
- Enforce host-based firewall rules that drop traffic to port 18790 from non-local sources
- Terminate or isolate the pinclaw process on systems where OpenClaw channel functionality is not required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.