CVE-2026-43579: OpenClaw Auth Bypass Vulnerability

CVE-2026-43579 Overview

CVE-2026-43579 is a missing authorization vulnerability [CWE-862] in OpenClaw versions prior to 2026.4.10. The flaw resides in the Nostr plugin's HTTP profile routes, where mutation endpoints fail to verify administrative authority before persisting profile configuration changes. Operators holding the operator.write scope can write Nostr profile settings that should require admin privileges.

The issue was published to the National Vulnerability Database (NVD) on 2026-05-06 and tracked through a GitHub Security Advisory and a VulnCheck advisory. Exploitation requires network access and a valid low-privileged account, but no user interaction.

Critical Impact
Authenticated operators can persist Nostr profile configuration changes without admin authority, undermining the privilege boundary enforced by OpenClaw's role model.

Affected Products

OpenClaw versions prior to 2026.4.10
OpenClaw Nostr plugin HTTP profile routes
Deployments granting the operator.write scope to non-admin users

Discovery Timeline

2026-05-06 - CVE-2026-43579 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43579

Vulnerability Analysis

The vulnerability is a broken access control issue in OpenClaw's Nostr plugin. The plugin exposes HTTP routes that mutate profile configuration, but those routes do not enforce an admin authority check on the request. Authorization is satisfied solely by the presence of the operator.write scope, which is intended for lower-privileged operational tasks.

Because the mutation handlers persist the supplied profile configuration directly, an operator can change Nostr settings that should be reserved for administrators. This breaks the separation between operator and admin roles defined elsewhere in the application.

The weakness corresponds to [CWE-862: Missing Authorization], where a function accepts privileged input without validating that the caller possesses the required role.

Root Cause

The root cause is that the Nostr profile mutation handlers check only for an authenticated session with operator.write scope and do not additionally verify that the principal holds admin authority. The fix, applied in commit 6517c700de9bb0ee11b41ab625ef3b63d01b6083, introduces the missing authority check on the affected routes. See the GitHub commit for the patch.

Attack Vector

The attack vector is network based. An attacker who already holds, or has compromised, a non-admin operator account with operator.write scope sends an HTTP request to the unprotected Nostr profile mutation endpoint. The server persists the request body as profile configuration. No social engineering or user interaction is needed.

Further technical details are available in the GitHub Security Advisory GHSA-f3h5-h452-vp3j and the VulnCheck Advisory.

Detection Methods for CVE-2026-43579

Indicators of Compromise

HTTP requests to Nostr profile mutation routes originating from sessions associated with non-admin operator accounts.
Unexpected modifications to persisted Nostr profile configuration that do not correlate with admin activity.
Audit log entries showing successful profile writes by principals lacking admin authority.

Detection Strategies

Compare the authenticated principal's role against the action performed on Nostr profile endpoints in application logs.
Alert when profile mutation requests are accepted from sessions whose token scope is operator.write without admin authority.
Hunt for divergence between expected admin-only configuration changes and actual change authorship.

Monitoring Recommendations

Forward OpenClaw HTTP access and audit logs to a centralized SIEM or data lake for correlation.
Track all changes to Nostr profile state and review them against an approved change list.
Baseline normal admin activity patterns so anomalous operator-driven configuration writes are surfaced quickly.

How to Mitigate CVE-2026-43579

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.10 or later, which contains the authority check fix.
Review and reduce the population of accounts that hold the operator.write scope to the minimum necessary.
Rotate credentials and API tokens for operator accounts if unauthorized profile changes are suspected.

Patch Information

The vulnerability is fixed in OpenClaw 2026.4.10. The corrective change is published in commit 6517c700de9bb0ee11b41ab625ef3b63d01b6083, which adds the missing admin authority check to the Nostr profile mutation routes. Refer to the GitHub Security Advisory for the full advisory.

Workarounds

Restrict network access to the Nostr plugin HTTP profile routes using a reverse proxy or web application firewall until the upgrade is applied.
Temporarily revoke the operator.write scope from accounts that do not require it.
Disable the Nostr plugin in deployments where it is not actively used.

bash

# Configuration example: upgrade to the patched release
git fetch --tags
git checkout v2026.4.10
# Rebuild and redeploy OpenClaw per project documentation