CVE-2026-100554

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-26

Last updated on: 2026-09-28

Assigner: VulnCheck

Description

OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability until WebSocket close cleanup completes. As a result, a revoked paired node can continue exercising its Canvas capability against the capability's configured routes during the close grace period. The issue is fixed in 2026.8.1; as a workaround, restart the Gateway after revoking a node that has Canvas access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-26

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-26

EPSS Evaluated

2026-10-14

NVD

CVE-2026-100554

EUVD

EUVD-2026-87496

Affected Vendors & Products

Vendor	Product	Version / Range
OpenClaw	OpenClaw	2026.5.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

OpenClaw versions between 2026.5.12 and 2026.8.1 have a flaw where revoking a node's access does not immediately invalidate Canvas HTTP authorization. The WebSocket client is terminated, but Canvas HTTP authorization remains active until the WebSocket cleanup completes, allowing a revoked node to access configured routes during this grace period.

Detection Guidance

Detecting this vulnerability requires checking if your OpenClaw version is between 2026.5.12 and 2026.8.1. Run 'npm list openclaw' to verify the installed version. If affected, monitor network traffic for unauthorized Canvas HTTP authorization requests from revoked nodes during WebSocket cleanup.

Impact Analysis

A revoked node could continue using its Canvas capability for a short time after revocation, potentially accessing restricted routes or data. The impact is limited to the capability's configured routes and the brief interval before connection cleanup. Practical effects are minimal due to the short grace period.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to insufficient session expiration (CWE-613). A revoked node retaining Canvas HTTP authorization during the WebSocket cleanup grace period may lead to unauthorized access to sensitive data, violating principles of least privilege and data protection requirements in these regulations.

Mitigation Strategies

Upgrade OpenClaw to version 2026.8.1 or later. As a temporary workaround, restart the Gateway after revoking any node with Canvas access to immediately invalidate lingering HTTP authorizations.

Hi! I’m here to help you understand CVE-2026-100554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70