CVE-2026-28450
Published: 05 March 2026
Summary
CVE-2026-28450 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-28450 is a missing authentication vulnerability (CWE-306) in OpenClaw versions prior to 2026.2.12 when the optional Nostr plugin is enabled. It exposes unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import, allowing operations on Nostr profiles without gateway authentication. The issue carries a CVSS v3.1 base score of 6.8 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) and was published on 2026-03-05.
Remote attackers can exploit these endpoints if the gateway HTTP port is accessible beyond localhost. Successful exploitation permits reading sensitive profile data, modifying Nostr profiles, persisting malicious changes to gateway configuration, and publishing signed Nostr events using the bot's private key.
Mitigation details are available in the OpenClaw GitHub security advisory (GHSA-mv9j-6xhh-g383) and the patch commit (647d929c9d0fd114249230d939a5cb3b36dc70e7), along with a VulnCheck advisory on the unauthenticated profile tampering via Nostr plugin HTTP endpoints. Affected users should update to OpenClaw 2026.2.12 or later to address the exposed endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9899
Vulnerability details
OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote attackers can exploit these endpoints to read sensitive profile data,…
more
modify Nostr profiles, persist malicious changes to gateway configuration, and publish signed Nostr events using the bot's private key when the gateway HTTP port is accessible beyond localhost.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability exposes unauthenticated HTTP endpoints in the OpenClaw gateway service, enabling remote exploitation of a public-facing application if the port is accessible beyond localhost, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly identifies and limits user actions performable without identification or authentication, preventing exploitation of the unauthenticated Nostr profile endpoints.
Enforces approved authorizations for logical access to information and resources, directly countering the missing authentication for reading and modifying profiles and configurations.
Monitors and controls communications at external boundaries, reducing exposure of the vulnerable HTTP endpoints accessible beyond localhost.