Junglewise Threat Intelligence

OpenClaw authentication bypass in Canvas gateway

Severity: medium · CVSS 5.1 · Published 2026-04-10

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a software package used for managing Canvas-based web interfaces. A security flaw in the Canvas gateway allows local users or processes to bypass authentication checks when making requests to the system. This could allow an unauthorized individual with local access to the server to view or modify data without providing valid credentials, potentially compromising the integrity of the application's operations.

Technical details

An authentication bypass vulnerability exists in OpenClaw versions prior to 2026.3.23 within the Canvas gateway component. The root cause is located in 'src/gateway/server/http-auth.ts', where the 'authorizeCanvasRequest()' function unconditionally returns a success state for requests identified as 'local-direct' (loopback) before performing bearer token or capability validation. An attacker with local access can exploit this by sending unauthenticated HTTP or WebSocket requests via the loopback interface to gain unauthorized access to Canvas routes. This issue is tracked as CVE-2026-35634 and has been patched in version 2026.3.23 by removing the early return logic for local requests.

Affected products

  • OpenClaw openclaw < 2026.3.23

Timeline

  • 2026-03-24: advisory: Original vendor advisory GHSA-6mqc-jqh6-x8fc published
  • 2026-04-09: disclosed: CVE-2026-35634 published to NVD
  • 2026-04-10: patched: Version 2026.3.23 released with fix

References

Related threats