CVEvulnerability

CVE-2026-41916

2.3 LOW Published 2026-04-28 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2026-04-28
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 4.0 ([email protected]): 2.3 LOW — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses: CWE-613

Description

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operations.

Affected configurations

• openclaw openclaw (< 2026.4.8)

Weakness · not in database (1)

CWE-613

References

https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-68x5-xx89-w9mm Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-stale-authentication-state-via-config-reload Third Party Advisory

CVE-2026-41916

Description

Affected configurations

Related

Weakness · not in database (1)

References