CVE-2026-35634: OpenClaw auth bypass grants

CISO Take

OpenClaw's Canvas gateway unconditionally trusts all loopback HTTP and WebSocket requests in versions before 2026.3.23, meaning any co-located process can call Canvas routes without presenting a bearer token or canvas capability — zero credentials required by design flaw. Although the local attack vector (AV:L) limits remote exposure, EPSS places this in the top 4% of CVEs by exploitation likelihood, and this package carries 396 prior CVEs, signalling a systemically vulnerable codebase that attackers clearly target. Critically, the malicious OpenClaw skills documented in AIID #1368 — which delivered credential stealers via ClawHub — represent exactly the co-located threat actor that can silently exploit this bypass post-installation with no further user interaction. Patch to OpenClaw ≥ 2026.3.23 immediately; if patching is delayed, restrict loopback Canvas port access via host firewall rules and audit all third-party skills in your environment.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Nominally medium severity (CVSS 5.1, AV:L/AC:L/PR:N/UI:N) but practically underrated in agentic deployment contexts. The zero-privilege, zero-interaction requirement means any co-located process — including AI skills installed from third-party registries — exploits this automatically without elevated access. EPSS at top 4th percentile despite a low absolute score reflects that this vulnerability class attracts real-world exploitation. The 396 CVEs in this package are a systemic red flag; teams should treat OpenClaw as high-risk pending sustained security improvement. Impact scope is confidentiality and integrity only (AV scoped Unchanged), but in environments where the Canvas agent holds API keys, database credentials, or access to internal tooling, the practical blast radius is considerably larger than the CVSS score suggests.

How does the attack unfold?

Initial Foothold

Attacker publishes a malicious OpenClaw skill to a public registry (e.g., ClawHub); victim developer installs it, placing attacker-controlled code on the same host as the Canvas gateway.

AML.T0011.002

Authentication Bypass

Malicious skill process sends unauthenticated HTTP/WebSocket requests to Canvas routes via loopback; authorizeCanvasRequest() detects the local-direct path and unconditionally grants access without validating the bearer token.

AML.T0091.000

Agent Configuration Enumeration

With unauthorized Canvas access, attacker reads agent tool manifests, configuration files, and stored context including API keys and access tokens for all downstream integrations the agent holds.

AML.T0084

Credential Exfiltration

Harvested credentials and API keys are silently transmitted to an attacker-controlled endpoint via Canvas tool invocation or direct HTTP exfil, with no authentication failure recorded in any gateway log.

AML.T0086

Initial Foothold

Attacker publishes a malicious OpenClaw skill to a public registry (e.g., ClawHub); victim developer installs it, placing attacker-controlled code on the same host as the Canvas gateway.

AML.T0011.002

Authentication Bypass

Malicious skill process sends unauthenticated HTTP/WebSocket requests to Canvas routes via loopback; authorizeCanvasRequest() detects the local-direct path and unconditionally grants access without validating the bearer token.

AML.T0091.000

Agent Configuration Enumeration

With unauthorized Canvas access, attacker reads agent tool manifests, configuration files, and stored context including API keys and access tokens for all downstream integrations the agent holds.

AML.T0084

Credential Exfiltration

Harvested credentials and API keys are silently transmitted to an attacker-controlled endpoint via Canvas tool invocation or direct HTTP exfil, with no authentication failure recorded in any gateway log.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

6 steps

Patch: Upgrade to OpenClaw ≥ 2026.3.23 immediately; the fix enforces bearer token and canvas capability validation for all request origins including loopback. Confirm patched commits 630f1479 and d5dc6b65 are present.
Verify version: Run pip show openclaw on all hosts to identify exposed instances.
Network control (if patching delayed): Apply host-based firewall rules (iptables, nftables, or macOS pf) to restrict which processes or UIDs can reach the Canvas gateway port on loopback — deny connections from untrusted process groups.
Skill hygiene: Immediately audit all third-party OpenClaw skills installed from external registries; remove or sandbox untrusted skills pending patch deployment.
Detection: Enable Canvas gateway request logging and alert on any request reaching Canvas routes that lacks an Authorization header — this should never occur in a patched deployment and indicates either an unpatched instance or active exploitation.
Credential rotation: If OpenClaw agents have held API keys, cloud credentials, or database passwords on any host running a vulnerable version, treat those credentials as potentially compromised and rotate them.

How is it classified?

Auth Bypass Data Extraction Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration AML.T0091.000 - Application Access Token AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2 - Policies for AI system use

NIST AI RMF

MANAGE 2.2 - Mechanisms to respond to AI risks

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-35634?

OpenClaw's Canvas gateway unconditionally trusts all loopback HTTP and WebSocket requests in versions before 2026.3.23, meaning any co-located process can call Canvas routes without presenting a bearer token or canvas capability — zero credentials required by design flaw. Although the local attack vector (AV:L) limits remote exposure, EPSS places this in the top 4% of CVEs by exploitation likelihood, and this package carries 396 prior CVEs, signalling a systemically vulnerable codebase that attackers clearly target. Critically, the malicious OpenClaw skills documented in AIID #1368 — which delivered credential stealers via ClawHub — represent exactly the co-located threat actor that can silently exploit this bypass post-installation with no further user interaction. Patch to OpenClaw ≥ 2026.3.23 immediately; if patching is delayed, restrict loopback Canvas port access via host firewall rules and audit all third-party skills in your environment.

Is CVE-2026-35634 actively exploited?

No confirmed active exploitation of CVE-2026-35634 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35634?

1. Patch: Upgrade to OpenClaw ≥ 2026.3.23 immediately; the fix enforces bearer token and canvas capability validation for all request origins including loopback. Confirm patched commits 630f1479 and d5dc6b65 are present. 2. Verify version: Run `pip show openclaw` on all hosts to identify exposed instances. 3. Network control (if patching delayed): Apply host-based firewall rules (iptables, nftables, or macOS pf) to restrict which processes or UIDs can reach the Canvas gateway port on loopback — deny connections from untrusted process groups. 4. Skill hygiene: Immediately audit all third-party OpenClaw skills installed from external registries; remove or sandbox untrusted skills pending patch deployment. 5. Detection: Enable Canvas gateway request logging and alert on any request reaching Canvas routes that lacks an Authorization header — this should never occur in a patched deployment and indicates either an unpatched instance or active exploitation. 6. Credential rotation: If OpenClaw agents have held API keys, cloud credentials, or database passwords on any host running a vulnerable version, treat those credentials as potentially compromised and rotate them.

What systems are affected by CVE-2026-35634?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI deployments, AI plugin ecosystems.

What is the CVSS score for CVE-2026-35634?

CVE-2026-35634 has a CVSS v3.1 base score of 5.1 (MEDIUM). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI deploymentsAI plugin ecosystems

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

AML.T0091.000 Application Access Token

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requests without validating bearer tokens or canvas capabilities. Attackers can send unauthenticated loopback HTTP and WebSocket requests to Canvas routes to bypass authentication and gain unauthorized access.

Exploitation Scenario

A threat actor publishes a malicious OpenClaw skill to ClawHub presenting as a legitimate productivity utility. A developer installs the skill on their workstation where OpenClaw also manages integrations to internal GitHub, cloud provider credentials, and a SIEM API. The malicious skill's background process immediately sends a series of unauthenticated HTTP requests to the local Canvas gateway (e.g., http://127.0.0.1:<port>/canvas/api/tools and /canvas/api/config) with a local-direct request marker. Because authorizeCanvasRequest() unconditionally grants access to all local-direct requests, the skill receives a full tool manifest and agent configuration dump including stored API tokens. The skill then silently exfiltrates these credentials to an attacker-controlled server with no user prompt, no visible UI change, and no authentication failure in any log — all before the developer opens the application. In enterprise environments, this single initial skill installation cascades into full compromise of every downstream system the OpenClaw agent was authorized to access.

Weaknesses (CWE)

CWE-288 Authentication Bypass Using an Alternate Path or Channel

CWE-288 — Authentication Bypass Using an Alternate Path or Channel: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

[Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE corpus.