Critical Authentication Bypass in OpenClaw (CVE‑2026‑3690) Threatens Canvas Services
What It Is — A remote authentication‑bypass vulnerability (CVE‑2026‑3690) in OpenClaw’s canvas endpoint implementation. An attacker can reach the service without presenting any credentials.
Exploitability — The flaw is network‑accessible (AV:N) and requires no user interaction (UI:N). No public exploit code has been released, but the vulnerability is trivial to weaponise. CVSS 7.4 (High).
Affected Products — OpenClaw (all versions prior to the March 2026 security patch).
TPRM Impact — Third‑party services that embed OpenClaw for canvas‑based authentication may be exposed to unauthorized access, potentially leading to data leakage, privilege escalation, or manipulation of downstream business processes across the supply chain.
Recommended Actions —
- Deploy the OpenClaw security update (GHSA‑vvjh‑f6p9‑5vcf) immediately.
- Conduct an inventory of all third‑party integrations that rely on OpenClaw canvas endpoints.
- Perform targeted penetration testing on those integrations to confirm the bypass is mitigated.
- Update contractual security clauses to require timely patching of critical authentication flaws and to mandate regular security‑posture attestations from vendors.