CVE-2026-41916CWE-613

OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload

Low · published April 28, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operations.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00378 · 30.5th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-04-28T18:10Z
EPSS history
Timeline
  • 28 APR 18:10Z
    OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload
    cvelistv5