Junglewise Threat Intelligence

OpenClaw authorization bypass in Nostr DM handling

Severity: low · CVSS 3.1 · Published 2026-04-10

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a framework for building decentralized applications that handles messaging via the Nostr protocol. The vulnerability allows attackers to send specially crafted direct messages that force the application to perform expensive cryptographic work before checking whether the sender is authorized to communicate. This could be exploited to exhaust system resources and cause a denial of service.

Technical details

This is an authorization bypass vulnerability (CWE-863 / CWE-696) in OpenClaw's Nostr direct message handling. The vulnerable code in extensions/nostr/src/channel.ts and extensions/nostr/src/nostr-bus.ts performed signature verification and NIP-04 decryption on inbound DMs before enforcing sender policy checks and pairing validation. An unauthenticated network attacker can send crafted DM messages to trigger resource-intensive cryptographic operations without prior authorization, enabling denial of service through computation exhaustion. The fix (patched in v2026.3.22) reorders operations to check sender policy and apply rate/size limits before any cryptographic work is performed.

Affected products

  • OpenClaw openclaw < 2026.3.22

Timeline

  • 2026-03-24: disclosed
  • 2026-03-22: patched: Fix released in v2026.3.22
  • 2026-04-09: advisory
  • 2026-04-10: other: Advisory GHSA-2j53-2c28-g9v2 withdrawn as duplicate of GHSA-65h8-27jh-q8wv

References

Related threats