CVE-2026-100554
Received Received - Intake

Canvas HTTP Authorization Bypass in OpenClaw

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability until WebSocket close cleanup completes. As a result, a revoked paired node can continue exercising its Canvas capability against the capability's configured routes during the close grace period. The issue is fixed in 2026.8.1; as a workaround, restart the Gateway after revoking a node that has Canvas access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100554
EUVD
EUVD-2026-87496

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenClaw versions between 2026.5.12 and 2026.8.1 have a flaw where revoking a node's access does not immediately invalidate Canvas HTTP authorization. The WebSocket client is terminated, but Canvas HTTP authorization remains active until the WebSocket cleanup completes, allowing a revoked node to access configured routes during this grace period.

Detection Guidance

Detecting this vulnerability requires checking if your OpenClaw version is between 2026.5.12 and 2026.8.1. Run 'npm list openclaw' to verify the installed version. If affected, monitor network traffic for unauthorized Canvas HTTP authorization requests from revoked nodes during WebSocket cleanup.

Impact Analysis

A revoked node could continue using its Canvas capability for a short time after revocation, potentially accessing restricted routes or data. The impact is limited to the capability's configured routes and the brief interval before connection cleanup. Practical effects are minimal due to the short grace period.

Mitigation Strategies

Upgrade OpenClaw to version 2026.8.1 or later. As a temporary workaround, restart the Gateway after revoking any node with Canvas access to immediately invalidate lingering HTTP authorizations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart