CVE-2026-35627: OpenClaw pre-auth DoS

CISO Take

OpenClaw before 2026.3.22 performs cryptographic decryption and message dispatch on inbound Nostr direct messages before validating sender identity or pairing policy, meaning any unauthenticated internet attacker can trigger unbounded computation at will. With no privileges required, no user interaction needed, and low attack complexity, every internet-exposed OpenClaw instance is reachable by automated tooling — and an EPSS rank in the top 64th percentile places exploitation likelihood above the vast majority of published CVEs despite the absence of a public PoC. The 396 prior CVEs in this package signal systemic security debt that should factor into any vendor risk decision beyond this single finding. Patch to OpenClaw ≥2026.3.22 immediately using commits 630f1479 and 1ee96110; if patching is delayed, restrict Nostr DM ingress to allowlisted relay endpoints at the network perimeter.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium severity by CVSS, but operationally elevated for AI agent deployments with internet-facing Nostr DM ingress. The AV:N/AC:L/PR:N/UI:N vector means exploitation requires only network connectivity — no credentials or social engineering. Sustained flooding can exhaust CPU and memory on the agent host, cascading into timeouts across any multi-agent coordination system relying on OpenClaw as a communication hub. The package's history of 396 CVEs is a material red flag for CISO vendor assessments; this vulnerability is unlikely to be an isolated incident.

How does the attack unfold?

Initial Access

Attacker discovers an internet-exposed OpenClaw agent instance via public Nostr relay enumeration — the protocol's public-key model makes agent endpoints discoverable without credentials.

AML.T0049

Exploitation

Attacker floods the target's Nostr DM inbox with high-rate crafted messages engineered to maximize pre-authentication cryptographic processing cost in OpenClaw's inbound handler.

AML.T0034.001

Resource Exhaustion

OpenClaw's runtime consumes CPU and memory executing cryptographic decryption and dispatch operations on attacker messages before the sender policy check fires, starving legitimate agent workloads.

AML.T0034.002

Impact — Agent Availability Failure

Legitimate agent tasks time out, inter-agent coordination messages are dropped, and cascading stalls propagate through any multi-agent pipeline relying on the degraded OpenClaw node.

AML.T0029

Initial Access

Attacker discovers an internet-exposed OpenClaw agent instance via public Nostr relay enumeration — the protocol's public-key model makes agent endpoints discoverable without credentials.

AML.T0049

Exploitation

Attacker floods the target's Nostr DM inbox with high-rate crafted messages engineered to maximize pre-authentication cryptographic processing cost in OpenClaw's inbound handler.

AML.T0034.001

Resource Exhaustion

OpenClaw's runtime consumes CPU and memory executing cryptographic decryption and dispatch operations on attacker messages before the sender policy check fires, starving legitimate agent workloads.

AML.T0034.002

Impact — Agent Availability Failure

Legitimate agent tasks time out, inter-agent coordination messages are dropped, and cascading stalls propagate through any multi-agent pipeline relying on the degraded OpenClaw node.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A Low

What should I do?

5 steps

Patch: Upgrade OpenClaw to ≥2026.3.22, applying both upstream commits (630f1479c44f and 1ee9611079e8).
Network controls: If patching is delayed, restrict Nostr DM ingress at the relay or firewall layer to allowlisted sender public keys — drop messages from unknown senders before they reach the OpenClaw process.
Rate limiting: Impose per-source rate limits on the Nostr relay connection to throttle inbound DM volume regardless of sender status.
Detection: Monitor CPU and memory utilization on OpenClaw hosts; anomalous compute spikes correlated with inbound DM bursts indicate active exploitation. Alert on sustained resource pressure above baseline during periods of elevated inbound message volume.
Long-term: Given 396 historical CVEs, conduct a formal vendor risk review of OpenClaw's suitability for production AI agent communication; evaluate alternative frameworks with stronger security track records.

How is it classified?

DoS Agent AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries AML.T0034.002 - Agentic Resource Consumption AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6 - AI System Availability and Resilience

NIST AI RMF

MANAGE 2.4 - Mechanisms for Responding to and Recovering from AI Risks

OWASP LLM Top 10

LLM04 - Model Denial of Service

Frequently Asked Questions

What is CVE-2026-35627?

OpenClaw before 2026.3.22 performs cryptographic decryption and message dispatch on inbound Nostr direct messages before validating sender identity or pairing policy, meaning any unauthenticated internet attacker can trigger unbounded computation at will. With no privileges required, no user interaction needed, and low attack complexity, every internet-exposed OpenClaw instance is reachable by automated tooling — and an EPSS rank in the top 64th percentile places exploitation likelihood above the vast majority of published CVEs despite the absence of a public PoC. The 396 prior CVEs in this package signal systemic security debt that should factor into any vendor risk decision beyond this single finding. Patch to OpenClaw ≥2026.3.22 immediately using commits 630f1479 and 1ee96110; if patching is delayed, restrict Nostr DM ingress to allowlisted relay endpoints at the network perimeter.

Is CVE-2026-35627 actively exploited?

No confirmed active exploitation of CVE-2026-35627 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35627?

1. Patch: Upgrade OpenClaw to ≥2026.3.22, applying both upstream commits (630f1479c44f and 1ee9611079e8). 2. Network controls: If patching is delayed, restrict Nostr DM ingress at the relay or firewall layer to allowlisted sender public keys — drop messages from unknown senders before they reach the OpenClaw process. 3. Rate limiting: Impose per-source rate limits on the Nostr relay connection to throttle inbound DM volume regardless of sender status. 4. Detection: Monitor CPU and memory utilization on OpenClaw hosts; anomalous compute spikes correlated with inbound DM bursts indicate active exploitation. Alert on sustained resource pressure above baseline during periods of elevated inbound message volume. 5. Long-term: Given 396 historical CVEs, conduct a formal vendor risk review of OpenClaw's suitability for production AI agent communication; evaluate alternative frameworks with stronger security track records.

What systems are affected by CVE-2026-35627?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-agent coordination systems, Nostr-based agent communication channels, Agent orchestration pipelines.

What is the CVSS score for CVE-2026-35627?

CVE-2026-35627 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-agent coordination systemsNostr-based agent communication channelsAgent orchestration pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

AML.T0034.002 Agentic Resource Consumption

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigger unauthorized pre-authentication computation by sending crafted DM messages, enabling denial of service through resource exhaustion.

Exploitation Scenario

An attacker enumerates Nostr relays to identify public keys associated with operational OpenClaw AI agent instances — this information is inherently public in the Nostr protocol. Without any credentials, the attacker scripts a high-rate Nostr DM flood, sending crafted messages structured to maximize the cost of pre-authentication cryptographic operations in OpenClaw's inbound handler. For each message, OpenClaw allocates CPU cycles for decryption and dispatcher evaluation before the sender policy check fires — the check that would reject the attacker's messages. Under sustained flood conditions, the host's available compute and memory are consumed servicing unauthorized pre-auth work, starving legitimate agent tasks: model inference calls time out, tool invocations queue indefinitely, and inter-agent coordination messages are dropped. In a chained multi-agent architecture, downstream agents waiting on responses from the degraded OpenClaw node stall in turn, multiplying the impact of a single availability failure.

Weaknesses (CWE)

CWE-696 Incorrect Behavior Order

CWE-696 — Incorrect Behavior Order: The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Source: MITRE CWE corpus.