CVE-2026-41388 MEDIUM

CVE-2026-41388: OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling

Vendor Openclaw

Product OpenClaw

Weakness CWE-372

Published April 28, 2026

Last update April 29, 2026

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file state, bypassing intended revocation controls.

Key dates

02Disclosure timeline

April 28, 2026 CVE published

April 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-41388 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/372.html

Related vulnerabilities

04Related CVE

CVE-2023-31127 DMTF-2023-0001: SPDM mutual authentication bypass CVE-2026-41340 OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration CVE-2023-36834 Junos OS: SRX 4600 and SRX 5000 Series: The receipt of specific genuine packets by SRXes configured for L2 transparency will cause a DoS CVE-2023-4012 Incomplete Internal State Distinction in ntpsec CVE-2021-25735 Validating Admission Webhook does not observe some previous fields