Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100554OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
Medium 4.2
In plain English
A medium-severity security flaw in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability until WebSocket close cleanup completes. As a result, a revoked paired node can continue exercising its Canvas capability against the capability's configured routes during the close grace period. The issue is fixed in 2026.8.1; as a workaround, restart the Gateway after revoking a node that has Canvas access.
Affected products (as reported)
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-g697-vv6h-r8hv) vendor-advisory
- VulnCheck Advisory: OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass third-party-advisory