{"action":"Upgrade openclaw to 2026.3.31 or later.","affected":[{"fixed":"2026.3.31","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41385"],"ecosystem":"npm","epss":0.00207,"exploited":false,"fixed_versions":["2026.3.31"],"ghsa_id":"GHSA-jjw7-3vjf-fg5j","id":"tcs_01M5KFYCK5ZXBA01PHXPAYHYHM","modified_at":"2026-05-06T02:51:10.411619Z","published_at":"2026-04-02T20:58:08Z","references":["https://osv.dev/vulnerability/GHSA-jjw7-3vjf-fg5j","https://github.com/openclaw/openclaw/security/advisories/GHSA-jjw7-3vjf-fg5j","https://nvd.nist.gov/vuln/detail/CVE-2026-41385","https://github.com/openclaw/openclaw/commit/57700d716f660591fb6e09727f3ca8041fa48b9d","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.3.31","https://www.vulncheck.com/advisories/openclaw-nostr-private-key-exposure-via-config-get-redaction-bypass"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-jjw7-3vjf-fg5j","url":"https://osv.dev/vulnerability/GHSA-jjw7-3vjf-fg5j"}],"summary":"OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get"}