CVE-2026-41916: OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload
OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41916?
CVE-2026-41916 is considered a high severity vulnerability due to its potential impact on authentication state management.
How do I fix CVE-2026-41916?
To fix CVE-2026-41916, upgrade OpenClaw to version 2026.4.8 or later.
What causes the vulnerability in CVE-2026-41916?
The vulnerability in CVE-2026-41916 is caused by the resolvedAuth closure becoming stale after a configuration reload.
What are the consequences of CVE-2026-41916?
The consequences of CVE-2026-41916 include the risk of new gateway connections using outdated authentication states.
Which versions of OpenClaw are affected by CVE-2026-41916?
CVE-2026-41916 affects OpenClaw versions prior to 2026.4.8.