OpenClaw releases prior to 2026.3.31 allow an attacker to send forged Nostr direct messages because the system fails to validate the event signature before processing pairing challenges. This flaw enables the creation of pending pairing entries without proper authorization, giving the attacker a foothold to flood the Nostr channel with unsolicited pairing‑reply attempts. The consequence is consumption of shared pairing capacity and execution of bound relay and logging workloads, which could degrade system performance or lead to denial of service for legitimate users.

OpenClaw application versions 2026.3.22 through 2026.3.30 are affected. The vulnerability applies broadly to all deployments of that product built with the mentioned versions and built on a Node.js runtime with the compound Nostr integration described by the CPE string.

The CVSS score of 6.9 indicates a moderate impact with limited scope if the attacker can reach the Nostr ingress path. No EPSS data is available, so the exploitation probability remains unknown, and the issue is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated remote request to the Nostr DM endpoint, exploiting the missing signature check to inject forged messages.