CVE-2026-108757
Received Received - Intake

Pinclaw OpenClaw Plugin Missing Authentication Vulnerability

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into the user's main OpenClaw agent session as user instructions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108757
EUVD
EUVD-2026-96922

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Nexting pinclaw 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication issue in the Nexting pinclaw OpenClaw channel plugin version 0.3.0 or earlier. It allows unauthenticated attackers to send blind prompts to a user's OpenClaw agent session by exploiting an unprotected POST endpoint at /pinclaw/send on port 18790, which is bound to all network interfaces by default.

Detection Guidance

Check if port 18790 is open and accessible on your network. Use commands like 'netstat -tuln | grep 18790' or 'ss -tuln | grep 18790' to verify if the service is listening. Inspect HTTP traffic to the endpoint POST /pinclaw/send for unauthenticated requests.

Impact Analysis

Unauthenticated attackers could inject malicious instructions into your OpenClaw agent session without your knowledge. This could lead to unauthorized actions, data manipulation, or exposure depending on how the agent processes the injected prompts. The impact severity is high due to the potential for arbitrary command execution or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, which may violate GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance failures could result in legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Block external access to port 18790 using firewall rules. Update the Nexting pinclaw plugin to the latest version if a patch is available. Monitor logs for suspicious POST /pinclaw/send requests without authToken.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108757. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart