Executive brief
OpenClaw is a Nostr protocol gateway/orchestration platform. A vulnerability in its Nostr plugin allowed users with basic write permissions to modify and persist profile configuration settings that should have required administrator-level authorization, potentially enabling unauthorized changes to Nostr profile data stored on disk.
Technical details
The vulnerability is an incorrect authorization (CWE-863) and privilege assignment flaw (CWE-266) in the Nostr plugin's HTTP profile mutation routes. The `/profile` (PUT) and `/profile/import` (POST) endpoints called `runtime.config.writeConfigFile()` without verifying that the caller held the required `operator.admin` scope—they only checked `operator.write` scope, the minimum required for plugin routes. This allowed any gateway-authenticated caller with write-level permissions to persistently modify Nostr profile configuration. The fix adds a sink-side scope guard (`enforceGatewayAdminMutationScope()`) that explicitly checks for `operator.admin` before executing the mutation. No network preconditions; the attacker must have valid gateway credentials with `operator.write` scope.
Affected products
- OpenClaw OpenClaw < 2026.4.10
Timeline
- 2026-04-17: disclosed
- 2026-04-10: patched: Fix merged in PR #63553; patched versions >= 2026.4.10