Is there a patch available for CVE-2026-41916?

Yes, a patch is available for CVE-2026-41916. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41916

Q: What is the CVSS score of CVE-2026-41916?

CVE-2026-41916 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26122 LOW

Insufficient Session Expiration (CWE-613)

2026-04-28 VulnCheck

Authentication Bypass Openclaw

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

Config reload must occur during connection window (AC:H); low-privilege attacker required (PR:L); partial C/I impact only with no scope change or availability loss.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:18 vuln.today

Analysis Generated

Jul 24, 2026 - 04:18 vuln.today

Severity Changed

Apr 28, 2026 - 19:52 NVD

MEDIUM LOW

CVSS changed

Apr 28, 2026 - 19:52 NVD

5.4 (MEDIUM) 2.3 (LOW)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26122

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:10 nvd

LOW 2.3

DescriptionCVE.org

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operations.

AnalysisAI

Authentication bypass in OpenClaw (npm package, all versions before 2026.4.8) allows low-privileged attackers to exploit a stale JavaScript closure - resolvedAuth - that is not refreshed after a gateway configuration reload, causing newly accepted connections to authenticate against outdated auth state. The CVSS 4.0 score is 2.3 with EPSS at 0.05% (16th percentile), reflecting low real-world exploitation probability; no active exploitation is confirmed and no CISA KEV listing exists. The vendor's own advisory explicitly scopes the issue to OpenClaw's user-controlled local assistant trust model and explicitly excludes multi-tenant service boundaries, sharply limiting blast radius.

Technical ContextAI

OpenClaw is a JavaScript npm package providing a user-controlled local AI gateway and assistant framework. The vulnerability is rooted in CWE-613 (Insufficient Session Expiration): at startup or configuration load, the gateway captures authentication state in a JavaScript closure (resolvedAuth). JavaScript closures bind variables at creation time and do not automatically update when the underlying data changes; when the gateway hot-reloads its configuration at runtime, the closure is not re-instantiated, so the stale pre-reload auth context persists for all subsequently accepted connections. The CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covers all versions through 2026.4.7, patched at 2026.4.8. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L) reflects that the attack path is network-reachable but requires specific conditions (AT:P) - namely that a config reload occurs - and that the attacker holds at minimum low-privilege access (PR:L).

RemediationAI

Upgrade the OpenClaw npm package to version 2026.4.8 or later. The fix is confirmed available in the npm registry and corresponds to commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 on the main branch, which was re-verified and includes targeted regression tests for the affected security boundary per the GHSA advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-68x5-xx89-w9mm. Additional context is available at the VulnCheck advisory https://www.vulncheck.com/advisories/openclaw-stale-authentication-state-via-config-reload. If immediate upgrade is not feasible, avoid performing hot configuration reloads on running OpenClaw gateway instances while they are actively accepting new connections; performing a full process restart rather than a live config reload ensures the resolvedAuth closure is freshly initialized from current configuration, eliminating the stale-state window. This workaround has no functional side effects beyond a brief service interruption during restart.