CVE-2026-35627

OVERVIEW CVE-2026-35627 is a denial-of-service vulnerability affecting OpenClaw versions prior to 2026.3.22. The flaw exists in how the application processes inbound Nostr direct messages, performing cryptographic and dispatch operations before validating sender identity and pairing policies. This premature processing enables attackers to consume system resources through crafted messages without proper authentication. SEVERITY The vulnerability carries a CVSS score of 8.2 (HIGH) with a network-based attack vector requiring no authentication or user interaction. While confidentiality is not impacted, the flaw introduces integrity concerns and poses significant availability risks through resource exhaustion attacks. The attack complexity is low, meaning exploitation requires minimal sophistication. EXPLOITATION STATUS There is currently no active exploitation occurring in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog, and community attention remains minimal as reflected by its inactive Hot List status. The EPSS score of 0.00085 indicates this vulnerability is currently in the lower range of exploitability likelihood, though organizations running affected OpenClaw versions should prioritize updating to version 2026.3.22 or later to mitigate pre-authentication denial-of-service attacks.