Path Traversal Information Disclosure in OpenClaw Canvas Gateway (CVE‑2026‑3689) Exposes Sensitive Data

Path Traversal Information Disclosure in OpenClaw Canvas Gateway (CVE‑2026‑3689)

What It Is – OpenClaw’s Canvas gateway endpoint fails to properly validate user‑supplied path parameters, resulting in a path‑traversal flaw (CVE‑2026‑3689). An authenticated remote attacker can read arbitrary files accessible to the service account, potentially exposing configuration secrets, credentials, or other sensitive data.

Exploitability – The vulnerability requires authentication but can be triggered remotely with low effort; a proof‑of‑concept is publicly available in the ZDI advisory. CVSS 6.5 (Medium) reflects the confidentiality impact and ease of exploitation.

Affected Products – OpenClaw (all versions prior to the vendor‑released patch).

TPRM Impact – Organizations that rely on OpenClaw as a third‑party service or integrate its API into internal workflows face a supply‑chain risk: compromised file reads could reveal API keys, internal network topology, or customer data processed by the service.

Recommended Actions –

1. Deploy the OpenClaw security update (GHSA‑jq4x‑98m3‑ggq6) immediately.
2. Verify that all instances run the patched version; inventory any legacy deployments.
3. Review access controls on the Canvas gateway; enforce least‑privilege service accounts and restrict network access to trusted subnets.
4. Enable detailed logging of canvas endpoint requests and monitor for anomalous path patterns.
5. Conduct a targeted file‑integrity audit on systems that interact with OpenClaw to ensure no sensitive files were accessed.

Source: Zero Day Initiative Advisory – ZDI‑26‑227