CVE-2026-108757: Missing Authentication for Critical Function in Nexting pinclaw
Description
Nexting pinclaw OpenClaw channel plugin versions up to 0.3.0 has a missing authentication vulnerability in the HTTP router component. This flaw allows unauthenticated attackers to bypass the authToken check on the POST /pinclaw/send endpoint. The service listens on port 18790 by default on all interfaces, enabling remote attackers to inject blind prompts into the user's main OpenClaw agent session without authentication.
CVSS v4.0
Score 7.1high
Affected software
Nexting
pinclaw
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108757 describes a missing authentication vulnerability in Nexting pinclaw OpenClaw channel plugin through version 0.3.0. Specifically, the vulnerability exists in the src/core/http-router.ts file where the authToken check is skipped for POST requests to /pinclaw/send. Because the service binds to port 18790 on all interfaces by default, unauthenticated attackers can remotely send requests that inject blind prompts into the user's main OpenClaw agent session, effectively issuing instructions as the user.
Potential Impact
An attacker who can reach port 18790 on a vulnerable system can send unauthenticated requests to inject prompts into the main OpenClaw agent session. This could lead to unauthorized command injection or manipulation of the user's session, potentially impacting the integrity and security of the agent's operations. The CVSS 4.0 base score is 7.1 (high severity), reflecting the ease of exploit without privileges or user interaction and the high impact on integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to port 18790 to trusted hosts only to prevent unauthenticated access. Monitor for unusual activity related to the OpenClaw agent session. Follow vendor updates closely for an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-11T01:57:27.711Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acb85c42cdf04f656d09a35
Added to database: 10/11/2026, 12:49:08 UTC
Last enriched: 10/11/2026, 13:03:23 UTC
Last updated: 10/11/2026, 21:33:11 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.