Which versions of OpenClaw are affected by EUVD-2026-26094?

OpenClaw versions before 2026.3.31 store Nostr protocol signing keys in plaintext, allowing authenticated network attackers to extract private keys through configuration retrieval methods and…. A patch is available.

How to fix or mitigate EUVD-2026-26094?

Within 24 hours: Identify all OpenClaw instances in production and determine current version numbers; if below 2026.3.31, isolate instances from non-trusted networks pending patching. Within 7 days: apply vendor patch to OpenClaw 2026.3.31 or later (GitHub commit 57700d716f660591fb6e09727f3ca8041fa48b9d); rotate all Nostr protocol signing keys post-patching. Within 30 days: audit access logs for unauthorized configuration retrieval and verify no malicious key usage occurred in signing operations.

OpenClaw EUVD-2026-26094

Q: What is the CVSS score of EUVD-2026-26094?

EUVD-2026-26094 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-41385 HIGH

Cleartext Storage of Sensitive Information (CWE-312)

2026-04-28 VulnCheck

Authentication Bypass Openclaw

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 20:03 vuln.today

Severity Changed

Apr 28, 2026 - 19:52 NVD

MEDIUM HIGH

CVSS changed

Apr 28, 2026 - 19:52 NVD

6.5 (MEDIUM) 7.1 (HIGH)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26094

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:09 nvd

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.

AnalysisAI

Plaintext private key storage in OpenClaw versions before 2026.3.31 exposes Nostr protocol signing keys through configuration retrieval methods. Authenticated attackers with network access can exploit redaction bypass in config.get methods to extract unencrypted private keys, enabling full impersonation of the compromised Nostr identity for signing and authentication operations. Vendor patch available via GitHub commit 57700d716f660591fb6e09727f3ca8041fa48b9d. EPSS and KEV data not available, but the authentication bypass tag and network attack vector indicate elevated risk for multi-tenant or shared OpenClaw deployments.

Technical ContextAI

This vulnerability stems from CWE-312 (Cleartext Storage of Sensitive Information) in OpenClaw's configuration management system. The Nostr protocol uses elliptic curve cryptography (typically secp256k1) for identity and message signing, where private keys must remain secret to prevent identity theft. OpenClaw stores these privateKey values in plaintext configuration objects rather than using secure storage mechanisms like encrypted keystores, hardware security modules, or OS-provided credential managers. The redaction mechanism intended to protect sensitive config values can be bypassed through direct config.get method invocations, likely due to insufficient access controls or inconsistent redaction logic across different API surfaces. The CPE cpe:2.3:a:openclaw:openclaw indicates this affects the core OpenClaw application across all versions prior to the 2026.3.31 release.

RemediationAI

Upgrade to OpenClaw version 2026.3.31 or later, which implements proper redaction and secure storage for Nostr private keys per commit 57700d716f660591fb6e09727f3ca8041fa48b9d available at https://github.com/openclaw/openclaw/commit/57700d716f660591fb6e09727f3ca8041fa48b9d. After patching, immediately rotate all Nostr private keys previously stored in affected OpenClaw configurations, as prior plaintext storage may have exposed them through logs, backups, or unauthorized access. For environments unable to upgrade immediately, implement defense-in-depth controls: restrict network access to OpenClaw configuration endpoints using firewall rules or reverse proxy authentication (blocks AV:N vector but adds operational overhead for legitimate admin access), enforce strict RBAC to prevent low-privilege accounts from invoking config.get methods (mitigates PR:L but requires application-layer changes), and move Nostr private keys to external secrets management systems like HashiCorp Vault or AWS Secrets Manager with OpenClaw configured to retrieve them via secure APIs rather than storing in plaintext config files (most robust but requires architecture changes and secrets management infrastructure). Review audit logs for unauthorized config.get calls between initial deployment and patch application to identify potential key compromise. Consult vendor advisory GHSA-jjw7-3vjf-fg5j for OpenClaw-specific migration guidance.