CVE-2026-41301

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41301
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41301.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41301
Aliases
Downstream
Published
2026-04-20T23:08:14.023Z
Modified
2026-07-15T01:49:19.228482219Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass
Details

OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges to be issued before event signature validation. An unauthenticated remote attacker can send forged direct messages to create pending pairing entries and trigger pairing-reply attempts, consuming shared pairing capacity and triggering bounded relay and logging work on the Nostr channel.

Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41301.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
e7d11f6c33e223a0dd8a21cfe01076bd76cef87a
Fixed
213a704b71f4996dc82a583288ee53785215f627
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2026.3.22"
        },
        {
            "fixed": "2026.3.31"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2026.*
v2026.3.22
v2026.3.23
v2026.3.23-2
v2026.3.23-beta.1
v2026.3.24
v2026.3.24-beta.1
v2026.3.24-beta.2
v2026.3.28
v2026.3.28-beta.1
v2026.3.31-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41301.json"