Executive brief
OpenClaw is a software package that handles communications on the Nostr protocol. A security flaw was found where the system would perform intensive cryptographic decryption on incoming private messages before verifying if the sender was authorized. This could allow an attacker to force the system to perform unauthorized computations, potentially leading to resource exhaustion or unauthorized data processing.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in OpenClaw's Nostr extension. The application processes inbound Direct Messages (DMs) by performing expensive cryptographic decryption and internal dispatching before validating sender identities or pairing policies. This allows a remote, unauthenticated attacker to trigger resource-intensive cryptographic operations. The fix, introduced in version 2026.3.22, implements authorization checks, size limits, and rate-limiting guardrails in 'channel.ts' and 'nostr-bus.ts' prior to decryption.
Affected products
- OpenClaw openclaw < 2026.3.22
Timeline
- 2026-03-22: patched: Fix released in version 2026.3.22
- 2026-03-24: disclosed
- 2026-03-26: advisory