Vulnerabilities

TI-2026-27735 CVE-2026-35634 · GHSA-6mqc-jqh6-x8fc

OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway

LOW 22

OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requests without validating bearer tokens or canvas capab…

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00147 Published 2026-04-09 Fixed in 2026.3.23 CWE-288

TI-2026-27719 CVE-2026-35618 · GHSA-cg6c-q2hx-69h7

OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification

LOW 36

OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00294 Published 2026-04-09 Fixed in 2026.3.23 CWE-294

Vulnerabilities

Filters

OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway

OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification