CVE-2026-108757 in pinclaw
Summary
by MITRE • 10/11/2026
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into the user's main OpenClaw agent session as user instructions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in Nexting pinclaw OpenClaw channel plugin versions up to and including 0.3.0 represents a critical authentication bypass that allows unauthenticated actors to interact directly with the application’s core messaging infrastructure. The root cause lies within the src/core/http-router.ts module, specifically concerning the handling of POST requests directed at the /pinclaw/send endpoint. In a properly secured implementation, this endpoint would require a valid authToken header or query parameter to verify that the requester is an authorized user or service. However, due to missing authentication logic in the routing layer, the application fails to validate credentials before processing incoming data. This oversight effectively exposes the internal communication channel of the OpenClaw agent system to any entity capable of reaching the network interface on which the service listens.
The operational impact of this vulnerability is severe because it enables blind prompt injection attacks against the main OpenClaw agent session. Since port 18790 binds to all interfaces by default, an attacker does not need local access or complex network pivoting if they are within reach of the host’s network segment. By sending a crafted POST request to this endpoint without providing authentication tokens, an adversary can inject arbitrary instructions into the context window of the AI agent. These injected prompts are treated as legitimate user input by the underlying large language model, potentially leading to unauthorized actions such as data exfiltration, execution of malicious code via function calling capabilities, or manipulation of the agent’s behavior to perform tasks outside its intended scope. This constitutes a classic case of prompt injection where the boundary between trusted system instructions and untrusted external input is blurred due to insufficient access controls.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the software does not adequately verify identity before granting access to protected resources. Furthermore, it relates closely to CWE-601 URL Redirection to Untrusted Site and CWE-94 Cross-Site Scripting in the context of server-side request forgery or injection attacks depending on how the injected prompts are processed by downstream systems. In terms of offensive security frameworks, this technique maps to MITRE ATT&CK Tactic TA0005 Defense Evasion through prompt manipulation and potentially TA0008 Lateral Movement if the agent has access to other networked services that can be triggered via these injected commands. The lack of authentication on a high-privilege endpoint like /pinclaw/send effectively bypasses all defensive layers designed to protect the integrity of the AI interaction loop.
Mitigation strategies must prioritize immediate remediation of the authentication gap and hardening of network exposure. Developers should enforce strict authentication checks within the http-router.ts module, ensuring that every request to sensitive endpoints such as POST /pinclaw/send includes a valid, verified token before any processing occurs. Implementing rate limiting on this endpoint can also help mitigate brute-force attempts if tokens are eventually implemented but remain weak. Additionally, changing the default binding address from all interfaces (0.0.0.0) to localhost or 127.0.0.1 is crucial for preventing remote exploitation over a network unless explicit external access is required and secured via reverse proxies with their own authentication layers. Regular security audits of AI integration points are recommended to ensure that prompt injection vectors remain closed as the application evolves, particularly when integrating third-party plugins or channels into core agent workflows.