OpenClaw versions prior to 2026.3.31 store Nostr private keys as unencrypted text in the configuration. The configuration retrieval API, config.get, bypasses the normal redaction logic, allowing an attacker to pull the entire configuration without masking. This vulnerability directly compromises the signing identities used for Nostr operations, potentially letting an attacker forge messages and impersonate legitimate users.

All installations of OpenClaw older than 2026.3.31 are affected. The issue is tied to the OpenClaw product from OpenClaw. No specific hardware or operating system is limited.

The CVSS score of 7.1 indicates moderate to high risk. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Attackers require access to the configuration API or a method to invoke config.get. The likely attack vector is through a vulnerable API endpoint or an insider who can read configuration files, but exploitation is technically feasible from any location that can reach the configuration interface. The impact is significant because it would allow the compromise of private keys used for Nostr protocol signing.