Is there a patch available for CVE-2026-41301?

Yes, a patch is available for CVE-2026-41301. Update the affected software to the latest version immediately.

Jwt Attack CVE-2026-41301

Q: What is the CVSS score of CVE-2026-41301?

CVE-2026-41301 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-21 disclosure@vulncheck.com

Authentication Bypass Jwt Attack

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 21, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 00:40 vuln.today

Analysis Generated

Apr 21, 2026 - 00:22 vuln.today

CVE Published

Apr 21, 2026 - 00:16 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.22.

DescriptionCVE.org

OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges to be issued before event signature validation. An unauthenticated remote attacker can send forged direct messages to create pending pairing entries and trigger pairing-reply attempts, consuming shared pairing capacity and triggering bounded relay and logging work on the Nostr channel.

AnalysisAI

OpenClaw 2026.3.22 through 2026.3.30 contain a signature verification bypass in the Nostr direct message (DM) ingress handler that processes pairing challenges before validating event signatures. Remote unauthenticated attackers can send forged DMs to create bogus pending pairing entries, exhaust shared pairing capacity, and trigger unbounded relay and logging work on the Nostr channel, causing denial of service. No public exploit code or active exploitation has been confirmed; a vendor patch is available in version 2026.3.31 and later.

Technical ContextAI

OpenClaw implements a Nostr protocol integration for direct messaging and peer pairing. The vulnerability stems from a logic flaw in the DM ingress validation pipeline (CWE-347: Improper Verification of Cryptographic Signature) where pairing challenge state is created and consumed before the initiating event's signature is cryptographically verified against the Nostr public key. Nostr events use Ed25519 signatures; by bypassing this validation step, an attacker can forge events with arbitrary sender claims. The affected DM ingress path is used to establish peer pairing relationships, which allocate shared resources (pairing capacity slots, relay bandwidth, logging buffers). The affected versions are OpenClaw CPE approximately cpe:2.3:a:openclaw:openclaw:2026.3.*:*:*:*:*:*:*:* for versions 2026.3.22 through 2026.3.30.

RemediationAI

Upgrade OpenClaw to version 2026.3.31 or later immediately; this is the vendor-released patch that adds signature validation before pairing challenge state creation. For deployments unable to upgrade immediately, implement network-level mitigation by restricting Nostr DM ingress to trusted peer sources via firewall rules or relay access control lists (ACLs). Specifically, disable or restrict inbound Nostr events from untrusted networks to the DM ingress port/endpoint, reducing attack surface at the cost of limiting peer discovery and legitimate pairing from external sources. Monitor Nostr relay and logging resource consumption (pairing queue depth, event buffer memory) and implement alerting thresholds to detect capacity exhaustion attacks; this does not prevent the vulnerability but provides early warning. If pairing capacity exhaustion occurs, manually flush pending pairing entries via administrative tools and restart the affected relay service to recover capacity; document this procedure for incident response. Do not rely on rate-limiting alone, as the attacker controls the forged event sender identity and can distribute attacks across many spoofed identities. The vendor recommends patching as the definitive fix, with no known workarounds that preserve full pairing functionality.