Nexting pinclaw: an unauthenticated route injects prompts into an agent

01What happened

HaiND, a security researcher at the Post and Telecommunication Institute of Technology in Vietnam, found that the pinclaw channel plugin exposes an agent prompt endpoint with no authentication. The GitHub Advisory Database, NVD and VulnCheck published the finding as CVE-2026-108757 on 11 October 2026, alongside HaiND's own write-up. None of the three records a vendor response.

02How it works

POST /pinclaw/send parses a JSON body, returns a request id and hands the message to the agent pipeline without ever comparing the authToken that sibling routes require. The message then arrives at the local OpenClaw Gateway as a chat.send call on the main session, carried by an operator connection holding admin, write and read scopes. Because the caller never sees the reply, the injection is blind. HaiND reports that the listener starts with no host argument, so Node binds every interface by default.

03Who is affected

Nexting installs that run the pinclaw channel plugin at version 0.3.0 or earlier are exposed, per the advisory. Reach decides the real risk: a loopback-only deployment limits callers to processes on the same host, while the default bind of port 18790 across all interfaces opens the endpoint to any caller on the local network.

04What to do

Bind the pinclaw listener to 127.0.0.1, or block port 18790 at the host firewall, until a patched release ships. HaiND also recommends routing every HTTP handler through a single authentication step so that a new route cannot skip the check, and dropping the wildcard CORS header from state-changing routes.

Questions people ask

Am I exposed if I only run Nexting on my own machine?

Nexting users on a single machine are still reachable by any local process, because pinclaw's listener starts without a host argument and Node then binds every interface. HaiND notes that a loopback-only deployment narrows exposure to processes on that host, while a LAN-reachable port 18790 lets any adjacent caller post prompts. Binding the listener to 127.0.0.1 closes the network path.

Is there a patched version of pinclaw?

No patched pinclaw release is listed. The GitHub Advisory Database, NVD and VulnCheck records for CVE-2026-108757 all give affected versions through 0.3.0, none names a fixed version, and none records a vendor response. Until a release ships, blocking port 18790 at the host firewall or binding the listener to loopback are the mitigations HaiND describes.

Can CVE-2026-108757 run code on my machine?

HaiND states the flaw is not remote code execution and not a secret read on its own. The injected text reaches the agent as user instructions, so harm depends on which tools that agent can call. HaiND did not test tool side effects or data disclosure, and did not establish a browser-based drive-by attack despite the route's wildcard CORS header.

Sources 4 links, all fetched

1. 1github.comGitHub Advisory
2. 2hackmd.ioResearcher Write-Up
3. 3github.comVulnerable Route
4. 4vulncheck.comVulnCheck Advisory