The CVE describes a settings reconciliation flaw in OpenClaw that treats explicitly empty allowlists as if they were not set. During reconciliation, this behavior can silently reverse revocations that were intended to deny access, effectively restoring permissions that should have been revoked. The flaw is a classic example of CWE-183, where the system fails to handle empty inputs as distinct from unset values, leading to an unintended privilege escalation or access control bypass.

All installations of OpenClaw running a version earlier than 2026.3.22 are affected. This includes every OpenClaw deployment regardless of the environment, because the vulnerability is present in the core settings reconciliation logic. Any system that relies on OpenClaw’s permission model is therefore at risk if it is not updated to at least version 2026.3.22.

The CVSS base score of 6.3 indicates a moderate severity risk. Because EPSS is not available and the vulnerability is not listed in the KEV catalog, the likelihood of widespread exploitation remains uncertain. It is inferred that the attacker would need the ability to modify or submit configuration changes that trigger settings reconciliation, which may require local or privileged access. Nonetheless, an attacker who can supply such configuration changes could gain elevated privileges or recover revoked permissions, potentially leading to significant security breaches.