Signature Verification Bypass Vulnerability in OpenClaw by OpenClaw
CVE-2026-41301

6.9MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
20 April 2026

What is CVE-2026-41301?

OpenClaw versions 2026.3.22 prior to 2026.3.31 exhibit a security flaw that allows attackers to bypass signature verification on Nostr DM ingress. This vulnerability enables unauthorized actors to send deceptive direct messages, leading to the creation of pending pairing entries. Once triggered, these pairing-reply attempts deplete shared pairing resources and initiate additional workloads on the Nostr channel, potentially compromising service performance and integrity.

Affected Version(s)

OpenClaw 2026.3.22 < 2026.3.31

OpenClaw 2026.3.31

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/4ee742174f36b...
patch
https://www.vulncheck.com/advisories/openclaw-forged-nost...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

smaeljaish771
KeenSecurityLab
.