Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigger unauthorized pre-authentication computation by sending crafted DM messages, enabling denial of service through resource exhaustion.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-09 | 2 | Disclosure2 |
| 2026-04-10 | 1 | Disclosure1 |
| 2026-04-15 | 1 | Patch1 |
OpenClaw patched CVE-2026-35627 - Nostr DM handling was doing crypto work before verifying the sender. Are you running the latest version of your Nostr client? https://www.vulncheck.com/advisories/openclaw-unauthenticated-cryptographic-work-in-nostr-inbound-dm-handling
Post summary
The advisory reports OpenClaw remedied CVE‑2026‑35627, which involved unverified crypto work in Nostr DMs; users should update to the latest client version.
CVE-2026-35627 Denial of Service via Pre-Authentication Computation in OpenClaw Before 2026.3.22 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35627
Post summary
The text announces CVE-2026-35627, a DoS vulnerability affecting OpenClaw versions before 2026.3.22, providing technical details but no PoC, exploit, or patch information.
🚨*CVE* CVE-2026-35627 OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attac… https://www.cve.org/CVERecord?id=CVE-2026-35627 ----- Traducción: CVE-2026-35627 Ope… http://infoflow.cloud`
Post summary
The text discloses CVE‑2026‑35627, noting that OpenClaw mishandles cryptographic operations on Nostr messages prior to policy checks, highlighting a potential logic flaw.
CVE-2026-35627 OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attac… https://www.cve.org/CVERecord?id=CVE-2026-35627
Post summary
The CVE discloses a flaw in OpenClaw where cryptographic and dispatch operations are executed on inbound Nostr direct messages prior to enforcing sender and pairing policy validation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |