CVE-2026-3690: OpenClaw Canvas Authentication Bypass Vulnerability

High severity · published Apr 11, 2026

CVE-2026-3690

OpenClaw Canvas Authentication Bypass Vulnerability

7.4

CVSS

0.7%

EPSS

On KEV

Description

OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 52% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OpenClaw · OpenClaw

2026.2.17 · source: vendor, NVD

In the news

VulnerabilityHigh

ZDI-26-228: OpenClaw Canvas Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.4. The following CVEs are assigned: CVE-2026-3690.

CVE-2026-3690

Mar 30, 2026·Zero Day Initiative

Affected product

OpenClaw

All OpenClaw CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-3690

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-3690

Exploit

https://github.com/openclaw/openclaw/security/advisories/GHSA-vvjh-f6p9-5vcf

Exploit

https://www.zerodayinitiative.com/advisories/ZDI-26-228/