PT-2026-29056 · Openclaw · Openclaw

Zdi-Disclosures · CVE-2026-3690 · Published 2026-03-04 · Updated 2026-04-19

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw (affected versions not specified)

Description A flaw exists in the authentication function for canvas endpoints in OpenClaw, resulting from an improper implementation of authentication. This allows remote attackers to bypass authentication without needing credentials. The issue was identified as ZDI-CAN-29311.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-291

Related Identifiers

CVE-2026-3690

GHSA-VVJH-F6P9-5VCF

ZDI-26-228

Affected Products

Openclaw

References · 9

• 🔥 https://github.com/openclaw/openclaw/security/advisories/GHSA-vvjh-f6p9-5vcf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3690.json · Exploit
• 🔥 https://zerodayinitiative.com/advisories/ZDI-26-228 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3690 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3690 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvjh-f6p9-5vcf · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/c45f3c5b004c8d63dc0e282e2176f8c9355d24f1 · Note
• https://twitter.com/CVEnew/status/2045972430599115136 · Twitter Post