Executive brief
OpenClaw is a JavaScript library for the Nostr protocol that manages cryptographic signing keys. A configuration redaction bypass allows applications using this library to inadvertently leak plaintext signing keys through the config.get() method, which was supposed to redact sensitive values. An attacker with local access or the ability to intercept configuration reads could obtain unencrypted private keys, compromising the integrity and authenticity of Nostr-based operations.
Technical details
OpenClaw models the Nostr privateKey as a plain string in its configuration system, circumventing the intended redaction mechanism that should protect sensitive values via the secret-schema library. The vulnerability exists because the config.get() method does not properly redact the privateKey field, exposing it in plaintext when configuration is accessed or logged. The attack requires local access to the application's configuration or interception of config.get() return values (no network attack vector documented). The fix, released in version 2026.3.31, addresses this by properly modeling the privateKey as a secret type that the redaction layer respects. Patched versions ≥2026.3.31 eliminate the exposure; users on ≤2026.3.28 are affected.
Affected products
- OpenClaw openclaw <=2026.3.28
Timeline
- 2026-04-02: disclosed: GHSA advisory published
- 2026-03-31: patched: Fix commit merged; version 2026.3.31 released with patch