CVE-2026-41385
OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass
Summary
OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass
Original description
The description as published by the source.
OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com