CVE-2026-41388: OpenClaw Auth Bypass Vulnerability

CVE-2026-41388 Overview

OpenClaw before version 2026.3.31 contains a configuration management vulnerability where startup migration incorrectly treats empty-array settings as missing values. This flaw allows attackers to restart the application and rehydrate revoked Tlon configuration from file state, effectively bypassing intended revocation controls. The vulnerability is classified under CWE-372 (Incomplete Internal State Distinction).

Critical Impact
Attackers can bypass configuration revocation controls by triggering application restarts, causing previously revoked Tlon settings to be restored from persistent file state.

Affected Products

OpenClaw versions prior to 2026.3.31
Tlon extension/monitor component
Systems using Tlon settings migration functionality

Discovery Timeline

2026-04-28 - CVE-2026-41388 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41388

Vulnerability Analysis

This vulnerability stems from incomplete internal state distinction in OpenClaw's Tlon settings migration logic. The core issue lies in how the application handles empty arrays during startup migration. When a configuration setting is explicitly set to an empty array (indicating revocation), the migration process fails to distinguish this intentional empty state from a truly missing or undefined value.

Upon application restart, the migration routine checks whether settings exist and determines if migration from file state is necessary. Because empty arrays are incorrectly treated as "missing," the system proceeds to rehydrate settings from the persistent file state, effectively restoring revoked configurations. This creates a security bypass where administrators believe they have revoked certain Tlon configurations, but those settings are silently restored after each application restart.

Root Cause

The root cause is improper validation logic in the Tlon settings migration helpers. The original implementation lacked a dedicated function to properly evaluate whether a setting should be migrated based on the explicit presence or absence of values. Empty arrays, which semantically represent "no items but explicitly configured," were treated identically to null or undefined values, which represent "not configured at all."

Attack Vector

The attack exploits the network-accessible nature of OpenClaw deployments. An attacker with the ability to trigger application restarts (either through direct access, denial-of-service conditions, or by waiting for scheduled maintenance) can exploit this vulnerability. The attack requires no authentication and leverages the predictable behavior of the migration routine:

Administrator revokes Tlon configuration by setting values to empty arrays
Attacker triggers or waits for application restart
Migration routine incorrectly identifies empty arrays as missing values
Previously revoked settings are restored from file state
Revoked configurations become active again

typescript

// Security patch in settings-helpers.ts
// Source: https://github.com/openclaw/openclaw/commit/a4d72a83f01fedd35964c352e3473c7712a3511b

export function shouldMigrateTlonSetting(fileValue: unknown, settingsValue: unknown): boolean {
  const hasFileValue = Array.isArray(fileValue) ? fileValue.length > 0 : fileValue != null;
  const hasSettingsValue = settingsValue != null;
  return hasFileValue && !hasSettingsValue;
}

The patch introduces a dedicated shouldMigrateTlonSetting function that properly distinguishes between empty arrays and truly missing values. The fix ensures that migration only occurs when a file value exists AND the settings value is genuinely undefined, preventing the rehydration of revoked configurations.

Detection Methods for CVE-2026-41388

Indicators of Compromise

Unexpected restoration of previously revoked Tlon configurations after application restarts
Audit log entries showing configuration changes that were not initiated by administrators
Discrepancies between expected empty-array settings and actual populated settings in the Tlon store
Repeated configuration drift following system reboots or service restarts

Detection Strategies

Monitor Tlon settings store for unauthorized changes, particularly settings that transition from empty arrays to populated values
Implement configuration drift detection to alert when revoked settings are unexpectedly restored
Review application startup logs for migration activities that should not occur with properly revoked settings
Compare settings state before and after application restarts to identify unintended rehydration events

Monitoring Recommendations

Enable verbose logging for the Tlon settings migration process to track all migration decisions
Set up alerts for any configuration changes occurring during application startup sequences
Implement file integrity monitoring on persistent Tlon configuration files
Create baseline snapshots of expected configuration states for comparison after restarts

How to Mitigate CVE-2026-41388

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.31 or later immediately
Review current Tlon configurations to identify any settings that may have been unintentionally restored
Re-apply any revoked configurations that may have been affected by this vulnerability
Audit application restart logs to determine if this vulnerability may have been exploited

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.31. The fix introduces the shouldMigrateTlonSetting helper function that correctly handles empty arrays as explicit configuration states rather than missing values. The patch is available via the GitHub commit. Additional details can be found in the GitHub Security Advisory GHSA-3pm9-5j7m-59vc and the VulnCheck Advisory.

Workarounds

Manually delete or rename persistent Tlon configuration files after revoking settings to prevent rehydration
Implement external configuration management that overwrites file-based settings after each restart
Use deployment automation to enforce expected configuration state following application restarts
Consider disabling automatic migration during startup if the feature is not required in your environment

bash

# Configuration example - Remove persistent Tlon config files after revocation
rm -f /path/to/openclaw/data/tlon-settings.json
# Or backup and clear the file
mv /path/to/openclaw/data/tlon-settings.json /path/to/backups/tlon-settings.json.bak