Openclaw cli: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement (CVE-2026-35627)

The OpenClaw CLI Nostr inbound DM processing performed cryptographic and dispatch operations before verifying sender authorization and pairing policies. This flaw enabled unauthenticated cryptographic computation triggered by inbound messages, which could lead to resource exhaustion or other impacts related to unauthorized pre-auth computation. The issue was corrected by reordering the authorization checks to occur before any expensive cryptographic work, as implemented in the fix shipped in version 2026.3.22.

Unauthorized parties could trigger cryptographic computations by sending inbound Nostr DMs without passing sender or pairing policy enforcement. This may result in resource exhaustion or denial of service due to unnecessary cryptographic processing. There is no indication of direct data compromise or privilege escalation from the provided data.

Upgrade OpenClaw CLI to version 2026.3.22 or later, where authorization checks are performed before any cryptographic processing of inbound Nostr DMs. This fix prevents unauthorized pre-auth computation. No additional mitigation is required once the update is applied.