CVE-2026-35634 MEDIUM

CVE-2026-35634: OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway

Vendor Openclaw

Product OpenClaw

Weakness CWE-288

Published April 9, 2026

Last update April 10, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requests without validating bearer tokens or canvas capabilities. Attackers can send unauthenticated loopback HTTP and WebSocket requests to Canvas routes to bypass authentication and gain unauthorized access.

Key dates

02Disclosure timeline

April 9, 2026 CVE published

April 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-35634 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/288.html

Related vulnerabilities

04Related CVE

CVE-2025-47461 WordPress Subaccounts for WooCommerce plugin <= 1.6.6 - Account Takeover vulnerability CVE-2024-2973 Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed CVE-2026-12225 syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent CVE-2026-7567 Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover CVE-2021-32980 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel