CVE-2026-41388

OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling

Published Apr 28, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file state, bypassing intended revocation controls.

Analysis

Technical impact

OpenClaw versions prior to 2026.3.31 interpret empty array configuration settings as if they were missing during startup migration. This behavior allows an adversary to restart the application and cause previously revoked Tlon configuration to be rehydrated from the file system, thereby bypassing the intended revocation controls. The flaw is a form of improper deletion or cleanup logic (CWE-372) and can enable unauthorized configuration activation within the application.

Affected Systems

The vulnerability affects the OpenClaw application, all releases before 2026.3.31, delivered in Node.js environments. No specific Node.js version dependence is noted beyond the existence of the OpenClaw component.

Risk and Exploitability

The CVSS score of 6.3 reflects a moderate severity. EPSS data is not available, and the issue is not listed in CISA KEV. Exploitation requires the ability to restart the OpenClaw instance; the attack vector is inferred to be local or privileged access. While not high risk by exploitation probability, the impact of revocation bypass can be significant to systems relying on strict configuration control.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenClaw

unaffected

Version	Status	Constraints
`0`	affected	< 2026.3.31
`2026.3.31`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Openclaw

Version	Status	Scheme	Platform
`[0,2026.3.31)`	affected	generic	—
`2026.3.31`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OpenClaw to version 2026.3.31 or later
Remove or set to null any revoked Tlon configuration entries in configuration files so they are not re‑hydrated
If an immediate upgrade is not possible, alter the startup migration process or adjust startup scripts to ignore empty‑array revocation handling to prevent rehydration
Monitor restart events and validate that revoked configurations remain absent after the upgrade or workaround

Generated by OpenCVE AI on April 28, 2026 at 23:05 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-3pm9-5j7m-59vc	OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.307% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openclaw/openclaw/commit/a4d72a83f01fedd35964c352e3473c7712a3511b
https://github.com/openclaw/openclaw/security/advisories/GHSA-3pm9-5j7m-59vc
https://www.vulncheck.com/advisories/openclaw-configuration-rehydration-via-empty-array-revocation-handling

History

Apr 29, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 28, 2026 7:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file state, bypassing intended revocation controls.
Title		OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling
First Time appeared		Openclaw Openclaw openclaw
Weaknesses		CWE-372
CPEs		cpe:2.3:a:openclaw:openclaw::::::node.js::*
Vendors & Products		Openclaw Openclaw openclaw
References		https://github.com/openclaw/openclaw/commit/a4d72a83f01fedd35964c352e3473c7712a3511b https://github.com/openclaw/openclaw/security/advisories/GHSA-3pm9-5j7m-59vc https://www.vulncheck.com/advisories/openclaw-configuration-rehydration-via-empty-array-revocation-handling
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`