OpenClaw versions prior to 2026.3.31 interpret empty array configuration settings as if they were missing during startup migration. This behavior allows an adversary to restart the application and cause previously revoked Tlon configuration to be rehydrated from the file system, thereby bypassing the intended revocation controls. The flaw is a form of improper deletion or cleanup logic (CWE-372) and can enable unauthorized configuration activation within the application.

The vulnerability affects the OpenClaw application, all releases before 2026.3.31, delivered in Node.js environments. No specific Node.js version dependence is noted beyond the existence of the OpenClaw component.

The CVSS score of 6.3 reflects a moderate severity. EPSS data is not available, and the issue is not listed in CISA KEV. Exploitation requires the ability to restart the OpenClaw instance; the attack vector is inferred to be local or privileged access. While not high risk by exploitation probability, the impact of revocation bypass can be significant to systems relying on strict configuration control.