VULNERABILITY INTELLIGENCE

CVE-2026-41385

CVSS score7.1 HIGH
EPSS probability0.21%
CISA KEVNot currently listed
Published2026-04-28
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Description

OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.

Weakness classification

  • CWE-312: Cleartext Storage of Sensitive Information

Primary references