CVE-2026-41916

MEDIUM 5.4

OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operations.

CWE	CWE-613
Vendor	openclaw
Product	openclaw
Published	Apr 28, 2026

Stay Ahead of the Next One

Get instant alerts for openclaw openclaw

Be the first to know when new medium vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

OpenClaw / OpenClaw

0 < 2026.4.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-68x5-xx89-w9mm github.com: https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 vulncheck.com: https://www.vulncheck.com/advisories/openclaw-stale-authentication-state-via-config-reload

Credits

🔍 KEXNA (@kexinoh)