CVE-2026-35634: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35634 is an authentication bypass vulnerability in the Canvas gateway of OpenClaw (npm package), classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The flaw exists in all versions of OpenClaw before 2026.3.23, where the authorizeCanvasRequest() function unconditionally permits local-direct (loopback) requests without validating bearer tokens or canvas capabilities. The vulnerability was published on April 9, 2026, with patches released in versions 2026.3.23 and 2026.3.23-2. It carries a CVSS v3.1 base score of 5.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Github Advisory).

The root cause resides in src/gateway/server/http-auth.ts, where authorizeCanvasRequest() contained an early-return path: if isLocalDirectRequest() evaluated to true (i.e., the request originated from a loopback address), the function immediately returned { ok: true } without performing any bearer token validation or checking for an active node canvas capability (CWE-288). This meant any process on the local machine could send unauthenticated HTTP or WebSocket requests to Canvas and A2UI routes and receive a successful response. The fix (commit d5dc6b6573ae489bc7e5651090f4767b93537c9e) removes the unconditional local-direct allow path entirely, requiring all Canvas route requests — including loopback ones — to present valid credentials. A regression test (denies canvas HTTP/WS on loopback without bearer or capability by default) was added to prevent recurrence (GitHub Advisory, Fix Commit).

Successful exploitation allows a local attacker to access Canvas functionality and interact with Canvas HTTP and WebSocket routes without providing valid credentials, resulting in low confidentiality and low integrity impacts. An attacker with local access could read Canvas-managed data and make unauthorized modifications to it. Availability is not affected, and there is no impact on subsequent systems beyond the vulnerable OpenClaw instance itself (Github Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the system running OpenClaw, limiting the attacker pool to those already present on the host or local network (Github Advisory, GitHub Advisory).

1. Identify target: Confirm the target system is running OpenClaw (npm) version earlier than 2026.3.23 with the Canvas gateway enabled and accessible via loopback.
2. Gain local access: Obtain local access to the host (e.g., via SSH, physical access, or another compromised local process) since the attack vector is local (loopback).
3. Craft unauthenticated loopback HTTP request: Send an HTTP GET or POST request directly to a Canvas route on the loopback interface without including a bearer token or canvas capability header, e.g.:

   curl http://127.0.0.1:<port>/canvas-host/

4. Exploit WebSocket route (optional): Establish an unauthenticated WebSocket connection to the Canvas WebSocket path on the loopback interface:

   wscat -c ws://127.0.0.1:<port>/canvas-ws

5. Access Canvas functionality: With authentication bypassed, interact with Canvas routes to read sensitive data or make unauthorized modifications to Canvas-managed content (GitHub Advisory, Fix Commit).

• Network: Unexpected HTTP or WebSocket requests to Canvas routes (e.g., /canvas-host/, /a2ui/, /canvas-ws) originating from loopback addresses (127.0.0.1, ::1) without an Authorization: Bearer header.
• Logs: OpenClaw gateway access logs showing 200 OK responses to Canvas or A2UI endpoints from loopback addresses with no bearer token present (on unpatched versions); after patching, 401 responses to such requests indicate attempted exploitation.
• Process: Unusual local processes or scripts making HTTP/WebSocket connections to OpenClaw's gateway port on the loopback interface without credentials.

Upgrade OpenClaw (npm) to version 2026.3.23 or later (including 2026.3.23-2), which removes the unconditional local-direct allow path in authorizeCanvasRequest(). The fix is contained in commits d5dc6b6573ae489bc7e5651090f4767b93537c9e (auth fix) and 630f1479c44f78484dfa21bb407cbe6f171dac87 (release preparation). As interim mitigations, restrict local network and loopback access to the OpenClaw gateway port to trusted users and processes, and implement network segmentation to limit which local processes can reach Canvas gateway endpoints. Monitor gateway logs for unauthenticated loopback requests to Canvas routes (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher @smaeljaish771 and sponsored by KeenSecurityLab, as credited in the official OpenClaw security advisory. The advisory was published by maintainer steipete on March 24, 2026, and a duplicate advisory (GHSA-9gvx-vj57-vqqx) was withdrawn on April 10, 2026, with a pointer to the canonical advisory GHSA-6mqc-jqh6-x8fc. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and VulnCheck advisory (GitHub Advisory, Github Advisory).