OpenClaw incorrect authorization in Nostr profile mutation routes

Executive brief

OpenClaw is an open-source software package. A vulnerability in its Nostr plugin allowed users with basic write permissions to modify and save profile configurations that should have been restricted to administrators. This could allow unauthorized users to change system settings, potentially leading to unauthorized configuration changes or persistent profile modifications.

Technical details

A vulnerability exists in the Nostr plugin of OpenClaw where HTTP profile mutation routes did not properly enforce administrative authorization. Specifically, the application allowed configuration persistence for users with 'operator.write' scope instead of requiring 'operator.admin' scope. An authenticated attacker with low privileges could exploit this to modify and persist profile configurations. The issue is classified under CWE-266 (Incorrect Privilege Assignment) and CWE-863 (Incorrect Authorization). A fix was introduced in version 2026.4.10 which mandates the 'operator.admin' scope for these routes.

Affected products

• openclaw openclaw < 2026.4.10

Timeline

• 2026-04-16: disclosed
• 2026-04-10: patched: First stable tag containing the fix is v2026.4.10
• 2026-04-17: advisory

References

• https://api.github.com/users/zpbrent
• https://github.com/zpbrent
• https://api.github.com/users/zpbrent/gists%7B/gist_id%7D
• https://api.github.com/users/zpbrent/repos
• https://avatars.githubusercontent.com/u/834641?v=4
• https://api.github.com/users/zpbrent/events%7B/privacy%7D