CVE-2026-108757: Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send
Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into the user's main OpenClaw agent session as user instructions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances of the Nexting pinclaw OpenClaw channel plugin through version 0.3.0 are exposed if an attacker can reach port 18790. The service binds to all interfaces by default, so network-reachable deployments are at risk.
What does an attacker need to exploit it?
An attacker needs only network access to port 18790 and can send a POST request to /pinclaw/send. No authentication, privileges, or user interaction are required.
What is the impact of successful exploitation?
An attacker can inject blind prompts into the user's main OpenClaw agent session as user instructions. The provided severity vector indicates integrity impact without confidentiality or availability impact.
How can I determine whether my deployment is affected?
Check whether the Nexting pinclaw OpenClaw channel plugin is version 0.3.0 or earlier, and whether its service on port 18790 is reachable by untrusted networks. The affected route is POST /pinclaw/send, where the authToken check is skipped.