CVE-2026-41385
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Apr 28, 2026
Vendor
unknown
Description
OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.