CVE-2026-94094: OpenClaw unbounded file read

CISO Take

OpenClaw's Canvas Host route has a resource-exhaustion flaw (CVE-2026-94094): it loads the whole requested file into memory with readFile() and applies no size limit. The sibling WebSocket path is capped at 64KB. An authenticated low-privilege user can trigger it remotely, and the impact is availability only, with no confidentiality or integrity loss. Severity is medium (CVSS 4.3). EPSS is 0.47%, in the 61st percentile, so exploitation is unlikely at scale. It is not in CISA KEV, and the SSVC decision is TRACK*. A public proof-of-concept report exists on GitHub, but no Nuclei template. The reported fix suggestion (streaming and a size limit) was never shipped, and the latest release, 2026.9.5, is still vulnerable. Patching is therefore not an option today. Until the vendor ships a fix, keep Canvas Host off untrusted networks, put a reverse-proxy limit on response and request sizes, and alert on memory spikes or restarts in OpenClaw agent hosts.

Sources:NVDEPSSVulDBATLAS

What is the risk?

Low-to-medium risk. The attack is remote, low complexity, needs no user interaction, and needs only low privileges (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, A:L). The impact is limited to availability, with no data exposure or code execution. EPSS 0.00471 (61st percentile) and no KEV listing or scanner template suggest low near-term mass exploitation. Risk rises where Canvas Host is internet-exposed or shared by many tenants, and because the latest release is unpatched and a public PoC report exists. The package risk score and dependent count are unknown, so blast radius cannot be quantified (no data).

How does the attack unfold?

Initial Access

Attacker reaches the OpenClaw Canvas Host route over the network with a low-privilege account.

AML.T0049

Exploitation

Attacker requests a large file repeatedly so createCanvasHostHandler buffers each whole file into memory via readFile().

Impact

Memory exhaustion crashes or stalls the OpenClaw service, making the agent canvas and co-hosted workflows unavailable.

AML.T0029

Initial Access

Attacker reaches the OpenClaw Canvas Host route over the network with a low-privilege account.

AML.T0049

Exploitation

Attacker requests a large file repeatedly so createCanvasHostHandler buffers each whole file into memory via readFile().

Impact

Memory exhaustion crashes or stalls the OpenClaw service, making the agent canvas and co-hosted workflows unavailable.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~6d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Check the OpenClaw vendor channel for a release newer than 2026.9.5 that adds streaming or a size limit, and upgrade as soon as one ships. 2) Until then, restrict network access to the Canvas Host route (bind to localhost or an internal segment, require VPN or an authenticated gateway). 3) Enforce a maximum response size and request rate limit at a reverse proxy (Caddy, nginx, or a WAF) in front of the canvas route. 4) Keep large files out of the canvas serving directory, and review who can place or upload files there. 5) Set container or cgroup memory limits and automatic restarts so one request cannot starve the host. 6) Detect: alert on repeated GETs to large canvas assets, process memory spikes, OOM kills, and unexpected OpenClaw restarts. 7) Review the public report at github.com/lche511/cve and the VulDB entries for reproduction details.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSAgentFrameworkAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and events

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-94094?

OpenClaw's Canvas Host route has a resource-exhaustion flaw (CVE-2026-94094): it loads the whole requested file into memory with readFile() and applies no size limit. The sibling WebSocket path is capped at 64KB. An authenticated low-privilege user can trigger it remotely, and the impact is availability only, with no confidentiality or integrity loss. Severity is medium (CVSS 4.3). EPSS is 0.47%, in the 61st percentile, so exploitation is unlikely at scale. It is not in CISA KEV, and the SSVC decision is TRACK*. A public proof-of-concept report exists on GitHub, but no Nuclei template. The reported fix suggestion (streaming and a size limit) was never shipped, and the latest release, 2026.9.5, is still vulnerable. Patching is therefore not an option today. Until the vendor ships a fix, keep Canvas Host off untrusted networks, put a reverse-proxy limit on response and request sizes, and alert on memory spikes or restarts in OpenClaw agent hosts.

Is CVE-2026-94094 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-94094, increasing the risk of exploitation.

How to fix CVE-2026-94094?

1) Check the OpenClaw vendor channel for a release newer than 2026.9.5 that adds streaming or a size limit, and upgrade as soon as one ships. 2) Until then, restrict network access to the Canvas Host route (bind to localhost or an internal segment, require VPN or an authenticated gateway). 3) Enforce a maximum response size and request rate limit at a reverse proxy (Caddy, nginx, or a WAF) in front of the canvas route. 4) Keep large files out of the canvas serving directory, and review who can place or upload files there. 5) Set container or cgroup memory limits and automatic restarts so one request cannot starve the host. 6) Detect: alert on repeated GETs to large canvas assets, process memory spikes, OOM kills, and unexpected OpenClaw restarts. 7) Review the public report at github.com/lche511/cve and the VulDB entries for reproduction details.

What systems are affected by CVE-2026-94094?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agent canvas/UI hosting, self-hosted AI assistants.

What is the CVSS score for CVE-2026-94094?

CVE-2026-94094 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagent canvas/UI hostingself-hosted AI assistants

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.

Exploitation Scenario

An attacker with a low-privilege account on a shared OpenClaw deployment, or access to an exposed Canvas Host, identifies or uploads a very large file in the canvas-served directory. They then send repeated concurrent GET requests for that file. Each request makes the server read the entire file into memory with readFile(), so memory use grows until the process slows or crashes. The agent's canvas and any co-hosted agent workflows become unavailable until the service restarts, and the attacker can repeat this at will.

Weaknesses (CWE)

CWE-404Improper Resource Shutdown or ReleasePrimary CWE-404Improper Resource Shutdown or Release

CWE-404 — Improper Resource Shutdown or Release: The product does not release or incorrectly releases a resource before it is made available for re-use.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
[Implementation] It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.

Source: MITRE CWE corpus.