CVE-2026-35634CWE-288

OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway

Medium · published April 9, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requests without validating bearer tokens or canvas capabilities. Attackers can send unauthenticated loopback HTTP and WebSocket requests to Canvas routes to bypass authentication and gain unauthorized access.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-04-09T21:27Z
EPSS history
Timeline
  • 09 APR 21:27Z
    OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway
    cvelistv5