GitHub Advisoryadvisory · npm

GHSA-jjw7-3vjf-fg5j OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

MEDIUM Published 2026-04-02 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-41385
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-312
Reviewed
2026-04-02

Affected packages

• npm openclaw: < 2026.3.31 → fixed in 2026.3.31

Description

Summary OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get Current Maintainer Triage • Status: open • Normalized severity: medium • Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema fix is unreleased. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version: `2026.3.31` • Vulnerable version range: `= 2026.3.31` • First stable tag containing the fix: `v2026.3.31` Fix Commit(s) • `57700d716f660591fb6e09727f3ca8041fa48b9d` — 2026-03-31T19:55:03+09:00 Release Process Note • The fix is already present in released version `2026.3.31`. • This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @ccreater222 for reporting.

Related

Alias · CVE (1)

  • CVE-2026-41385 OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References