CVE-2026-35634

MEDIUM

OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requests without validating bearer tokens or canvas capabilities. Attackers can send unauthenticated loopback HTTP and WebSocket requests to Canvas routes to bypass authentication and gain unauthorized access.

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-6mqc-jqh6-x8fc)
https://github.com/openclaw/openclaw/security/advisories/GHSA-6mqc-jqh6-x8fc
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway
https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-local-direct-requests-in-canvas-gateway

Scores

CVSS v3 5.1
EPSS 0.0014
EPSS Percentile 3.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-288
Status published
Products (4)
npm/openclaw 0 - 2026.3.23npm
OpenClaw/OpenClaw < 2026.3.23
openclaw/openclaw < 2026.3.23
OpenClaw/OpenClaw 2026.3.23
Published Apr 09, 2026
Tracked Since Apr 10, 2026