OpenClaw before 2026.4.10 suffers from insufficient access control on Nostr plugin HTTP profile routes, allowing any operator with write permissions to persist profile configuration without admin authority. This flaw permits attackers with operator.write scope to modify Nostr profile settings through unprotected mutation endpoints, granting them unauthorized configuration persistence that could affect application behavior or data integrity.

The vulnerability affects the OpenClaw product of the OpenClaw vendor. All installations running any version earlier than 2026.4.10 are impacted, as the issue is resolved in that release and later versions.

The CVSS score of 6 signals moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The likely attack vector is through the application's exposed HTTP endpoints, requiring the attacker to have operator.write privileges, which may be granted to legitimate users. Given the moderate severity and typical deployment context, the risk is moderate with a potential for persistent unauthorized configuration changes if the privileged scope is compromised.