Path Traversal Information Disclosure in OpenClaw Canvas Gateway (CVE‑2026‑3689)
What It Is – OpenClaw’s Canvas gateway endpoint fails to properly validate user‑supplied path parameters, resulting in a path‑traversal flaw (CVE‑2026‑3689). An authenticated remote attacker can read arbitrary files accessible to the service account, potentially exposing configuration secrets, credentials, or other sensitive data.
Exploitability – The vulnerability requires authentication but can be triggered remotely with low effort; a proof‑of‑concept is publicly available in the ZDI advisory. CVSS 6.5 (Medium) reflects the confidentiality impact and ease of exploitation.
Affected Products – OpenClaw (all versions prior to the vendor‑released patch).
TPRM Impact – Organizations that rely on OpenClaw as a third‑party service or integrate its API into internal workflows face a supply‑chain risk: compromised file reads could reveal API keys, internal network topology, or customer data processed by the service.
Recommended Actions –
- Deploy the OpenClaw security update (GHSA‑jq4x‑98m3‑ggq6) immediately.
- Verify that all instances run the patched version; inventory any legacy deployments.
- Review access controls on the Canvas gateway; enforce least‑privilege service accounts and restrict network access to trusted subnets.
- Enable detailed logging of canvas endpoint requests and monitor for anomalous path patterns.
- Conduct a targeted file‑integrity audit on systems that interact with OpenClaw to ensure no sensitive files were accessed.