CVE-2026-41388: OpenClaw Auth Bypass Vulnerability

CVE-2026-41388 Overview

OpenClaw before version 2026.3.31 contains a configuration management vulnerability where startup migration incorrectly treats empty-array settings as missing values. This flaw allows attackers to restart the application and rehydrate revoked Tlon configuration from file state, effectively bypassing intended revocation controls. The vulnerability is classified under CWE-372 (Incomplete Internal State Distinction).

Critical Impact

Attackers can bypass configuration revocation controls by triggering application restarts, causing previously revoked Tlon settings to be restored from persistent file state.

Affected Products

• OpenClaw versions prior to 2026.3.31
• Tlon extension/monitor component
• Systems using Tlon settings migration functionality

Discovery Timeline

• 2026-04-28 - CVE-2026-41388 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41388

Vulnerability Analysis

This vulnerability stems from incomplete internal state distinction in OpenClaw's Tlon settings migration logic. The core issue lies in how the application handles empty arrays during startup migration. When a configuration setting is explicitly set to an empty array (indicating revocation), the migration process fails to distinguish this intentional empty state from a truly missing or undefined value.

Upon application restart, the migration routine checks whether settings exist and determines if migration from file state is necessary. Because empty arrays are incorrectly treated as "missing," the system proceeds to rehydrate settings from the persistent file state, effectively restoring revoked configurations. This creates a security bypass where administrators believe they have revoked certain Tlon configurations, but those settings are silently restored after each application restart.

Root Cause

The root cause is improper validation logic in the Tlon settings migration helpers. The original implementation lacked a dedicated function to properly evaluate whether a setting should be migrated based on the explicit presence or absence of values. Empty arrays, which semantically represent "no items but explicitly configured," were treated identically to null or undefined values, which represent "not configured at all."

Attack Vector

The attack exploits the network-accessible nature of OpenClaw deployments. An attacker with the ability to trigger application restarts (either through direct access, denial-of-service conditions, or by waiting for scheduled maintenance) can exploit this vulnerability. The attack requires no authentication and leverages the predictable behavior of the migration routine:

1. Administrator revokes Tlon configuration by setting values to empty arrays
2. Attacker triggers or waits for application restart
3. Migration routine incorrectly identifies empty arrays as missing values
4. Previously revoked settings are restored from file state
5. Revoked configurations become active again

// Security patch in settings-helpers.ts
// Source: https://github.com/openclaw/openclaw/commit/a4d72a83f01fedd35964c352e3473c7712a3511b

export function shouldMigrateTlonSetting(fileValue: unknown, settingsValue: unknown): boolean {
  const hasFileValue = Array.isArray(fileValue) ? fileValue.length > 0 : fileValue != null;
  const hasSettingsValue = settingsValue != null;
  return hasFileValue && !hasSettingsValue;
}

The patch introduces a dedicated shouldMigrateTlonSetting function that properly distinguishes between empty arrays and truly missing values. The fix ensures that migration only occurs when a file value exists AND the settings value is genuinely undefined, preventing the rehydration of revoked configurations.

Detection Methods for CVE-2026-41388

Indicators of Compromise

• Unexpected restoration of previously revoked Tlon configurations after application restarts
• Audit log entries showing configuration changes that were not initiated by administrators
• Discrepancies between expected empty-array settings and actual populated settings in the Tlon store
• Repeated configuration drift following system reboots or service restarts

Detection Strategies

• Monitor Tlon settings store for unauthorized changes, particularly settings that transition from empty arrays to populated values
• Implement configuration drift detection to alert when revoked settings are unexpectedly restored
• Review application startup logs for migration activities that should not occur with properly revoked settings
• Compare settings state before and after application restarts to identify unintended rehydration events

Monitoring Recommendations

• Enable verbose logging for the Tlon settings migration process to track all migration decisions
• Set up alerts for any configuration changes occurring during application startup sequences
• Implement file integrity monitoring on persistent Tlon configuration files
• Create baseline snapshots of expected configuration states for comparison after restarts

How to Mitigate CVE-2026-41388

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.31 or later immediately
• Review current Tlon configurations to identify any settings that may have been unintentionally restored
• Re-apply any revoked configurations that may have been affected by this vulnerability
• Audit application restart logs to determine if this vulnerability may have been exploited

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.31. The fix introduces the shouldMigrateTlonSetting helper function that correctly handles empty arrays as explicit configuration states rather than missing values. The patch is available via the GitHub commit. Additional details can be found in the GitHub Security Advisory GHSA-3pm9-5j7m-59vc and the VulnCheck Advisory.

Workarounds

• Manually delete or rename persistent Tlon configuration files after revoking settings to prevent rehydration
• Implement external configuration management that overwrites file-based settings after each restart
• Use deployment automation to enforce expected configuration state following application restarts
• Consider disabling automatic migration during startup if the feature is not required in your environment

# Configuration example - Remove persistent Tlon config files after revocation
rm -f /path/to/openclaw/data/tlon-settings.json
# Or backup and clear the file
mv /path/to/openclaw/data/tlon-settings.json /path/to/backups/tlon-settings.json.bak