PT-2026-31769 · Openclaw · Openclaw

Smaeljaish771 · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-35634

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.23

Description OpenClaw contains an authentication bypass in the Canvas gateway. The authorizeCanvasRequest() function unconditionally allows local-direct requests without validating bearer tokens or canvas capabilities. This allows attackers to send unauthenticated HTTP and WebSocket requests to Canvas routes, bypassing authentication and gaining unauthorized access.

Recommendations Update to version 2026.3.23 or later.

Fix

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

CVE-2026-35634

GHSA-6MQC-JQH6-X8FC

GHSA-9GVX-VJ57-VQQX

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6mqc-jqh6-x8fc · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d5dc6b6573ae489bc7e5651090f4767b93537c9e · Patch
• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://osv.dev/vulnerability/GHSA-6mqc-jqh6-x8fc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35634 · Security Note
• https://osv.dev/vulnerability/GHSA-9gvx-vj57-vqqx · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/infoflowcloud/status/2042366285623755104 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authentication-bypass-via-local-direct-requests-in-canvas-gateway · Note
• https://twitter.com/VulmonFeeds/status/2042467051013312671 · Twitter Post
• https://twitter.com/CVEnew/status/2042364322853105690 · Twitter Post