N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-f3h5-h452-vp3j

GHSA-f3h5-h452-vp3j: OpenClaw: Nostr profile mutation routes allowed operator.write config persistence

Summary

Nostr profile mutation routes allowed operator.write config persistence.

Affected Packages / Versions

Package: openclaw
Ecosystem: npm
Affected versions: < 2026.4.10
Patched versions: >= 2026.4.10

Impact

Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin authority.

Technical Details

The fix requires operator.admin scope for Nostr profile mutation routes.

Fix

The issue was fixed in #63553. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix.

Fix Commit(s)

6517c700de9bb0ee11b41ab625ef3b63d01b6083
PR: #63553

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-f3h5-h452-vp3j

GHSA-f3h5-h452-vp3j:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.10	2026.4.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Nostr plugin's HTTP API for profile management. Specifically, the handleUpdateProfile and handleImportProfile functions, which correspond to the PUT /api/channels/nostr/:accountId/profile and POST /api/channels/nostr/:accountId/profile/import routes respectively, were missing a critical authorization check. The system was designed to allow only administrators (operator.admin scope) to perform these actions, but the code only checked for a general write permission (operator.write scope). This allowed any authenticated user with write access to modify the Nostr profile configuration, which could lead to unauthorized changes.

The patch addresses this by introducing a new authorization layer. First, the Nostr API route is marked with gatewayRuntimeScopeSurface: "trusted-operator" in extensions/nostr/index.ts. This signals to the gateway that requests to this route need special scope handling. Second, a new function, enforceGatewayMutationScope, is added in extensions/nostr/src/nostr-profile-http.ts, which explicitly checks if the request's security context includes the operator.admin scope. This new check is then called at the beginning of both handleUpdateProfile and handleImportProfile, ensuring that any request to modify a Nostr profile is properly authorized, thus closing the privilege escalation gap.

Vulnerable functions

handleUpdateProfile

extensions/nostr/src/nostr-profile-http.ts

This function handles HTTP requests to update a Nostr profile. Before the patch, it did not perform an authorization check to ensure the user had 'operator.admin' privileges. This allowed any user with 'operator.write' permissions to modify the Nostr profile configuration, leading to an incorrect privilege assignment vulnerability. The patch added the 'enforceGatewayMutationScope' check to ensure only administrators can update the profile.

handleImportProfile

extensions/nostr/src/nostr-profile-http.ts

This function handles HTTP requests to import a Nostr profile. The vulnerability existed because this function, like 'handleUpdateProfile', did not check for 'operator.admin' scope before proceeding. This allowed a user with lesser 'operator.write' privileges to import a profile, potentially overwriting existing settings. The fix introduces the 'enforceGatewayMutationScope' call to enforce proper authorization.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-f3h5-h452-vp3j: OpenClaw: Nostr profile mutation routes allowed operator.write config persistence

Summary

Affected Packages / Versions

Impact

Technical Details

Fix

Fix Commit(s)

Release Process Note

Credits

GHSA-f3h5-h452-vp3j:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

GHSA-f3h5-h452-vp3j: OpenClaw: Nostr profile mutation routes allowed operator.write config persistence

Summary

Affected Packages / Versions

Impact

Technical Details

Fix

Fix Commit(s)

Release Process Note

Credits

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI