CVE-2026-41301 MEDIUM

CVE-2026-41301: OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass

Vendor Openclaw
Product OpenClaw
Weakness CWE-347
Published April 20, 2026
Last update April 21, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges to be issued before event signature validation. An unauthenticated remote attacker can send forged direct messages to create pending pairing entries and trigger pairing-reply attempts, consuming shared pairing capacity and triggering bounded relay and logging work on the Nostr channel.

Key dates

02Disclosure timeline

April 20, 2026 CVE published
April 21, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user. CVE-2021-29108 There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below. CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability CVE-2020-11093 Authorization bypass in Hyperledger Indy CVE-2020-15705 GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim