In OpenClaw versions prior to 2026.4.8, the authentication state handling can become stale after a configuration reload. The resolvedAuth closure, which holds the current authentication rules, is not refreshed when configuration changes are applied. Consequently, any new gateway connection that is established after such a reload continues to use the outdated authentication state. Attackers can exploit this behavior to bypass authentication controls, allowing unauthorized access to the system. The vulnerability stems from improper state synchronization, a classic example of CWE‑613, where stale authentication data can be used by attackers to gain privileges they should not possess.

The vulnerability affects the OpenClaw platform, specifically all deployments of OpenClaw before version 2026.4.8. Since the product is built on Node.js, any instance running the affected version in any environment that processes gateway connections is susceptible.

The CVSS score of 2.3 indicates a low severity impact on confidentiality, integrity, and availability. No exploit probability score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector likely requires an operator or an attacker with access to trigger configuration reloads, after which the stale authentication state grants unauthorized access. The fact that a reload can be performed manually or automatically means that a compromised user could potentially manipulate the authentication data if the reload operation is not secured.