VULNERABILITY INTELLIGENCE

CVE-2026-41388

CVSS score6.5 MEDIUM

EPSS probability0.31%

CISA KEVNot currently listed

Published2026-04-28

Last modified2026-06-17

Description

OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file state, bypassing intended revocation controls.