Listen to this Post
How the mentioned CVE works:
The vulnerability resides in inbound Nostr direct message (DM) handling prior to version 2026.3.22. When a Nostr event of kind 4 (encrypted DM) or similar is received, the affected code path first performs cryptographic decryption (NIP‑04/NIP‑44) and dispatches the decrypted content to internal handlers. Only after this expensive crypto and dispatch work does it enforce sender authorization and pairing policy checks. An attacker can abuse this ordering by sending crafted events from any Nostr public key, even without an established pairing. The server will decrypt the message, potentially perform additional processing, and only then reject it due to missing permissions. This results in unauthorized pre‑authentication computation: CPU cycles, memory allocations, and cryptographic operations are consumed before any policy is applied. Repeated exploitation can cause resource exhaustion, degrade performance, and bypass rate‑limiting that would otherwise block unauthenticated requests earlier. The fix moved authorization, size limits, and rate guardrails before the decryption step, as seen in `extensions/nostr/src/nostr-bus.ts` and extensions/nostr/src/channel.ts, ensuring no expensive work is performed for untrusted senders.
DailyCVE Form:
Platform: openclaw npm package
Version: before 2026.3.22
Vulnerability: pre-auth crypto abuse
Severity: Medium
date: March 26 2026
Prediction: Patched 2026.3.22
What Undercode Say:
Analytics – Bash commands and code snippets to detect and verify the vulnerability:
Check installed openclaw version npm list openclaw | grep openclaw Verify fix commit presence (after upgrade) git log --oneline | grep 1ee9611079e81b9122f4bed01abb3d9f56206c77 Simulate a malicious DM (requires nostr-tool or similar) nostr event --kind 4 --content "encrypted payload" --pubkey <attacker_pubkey> --relay wss://target-relay Check if server logs show decryption attempts before policy reject (pre-patch behavior) grep "decrypting DM" /var/log/openclaw.log | grep "unauthorized"
Exploit:
An attacker with any Nostr keypair sends a large number of kind‑4 events to the target relay. Each event triggers full NIP‑04 decryption and dispatch logic on the server before the pairing policy is checked. By varying the encrypted payload size or using computationally expensive ciphers, the attacker forces sustained CPU/memory spikes. No prior relationship or pairing is required; the server wastes resources on every inbound DM even though they are ultimately rejected.
Protection from this CVE
- Upgrade to openclaw >= 2026.3.22 immediately via
npm install openclaw@latest. - If immediate upgrade is impossible, apply the fix commit `1ee9611079e81b9122f4bed01abb3d9f56206c77` manually.
- Implement network‑level rate limiting on Nostr relay endpoints to reduce flood potential.
- Monitor logs for excessive DM‑related decryption errors as an indicator of exploitation attempts.
Impact
- Unauthorized resource consumption (CPU, memory) leading to denial of service.
- Bypass of authentication and policy enforcement due to out‑of‑order operations.
- Increased operational costs and degraded relay performance for legitimate users.
- Potential for further attack chaining if crypto work triggers unhandled exceptions or state corruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
