← Back

CVE-2026-3690

nvd nist
Published: Apr 11, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.4
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 2.2 / Impact: 5.2
Source: zdi-disclosures@trendmicro.com (Secondary)

Description

OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311.

Affected (1)

Products: Openclaw: Openclaw
Openclaw
1 product
Openclaw
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Openclaw
Before 2026.2.19

Related CWEs

CWE-291
Reliance on IP Address for Authentication
The product uses an IP address for authentication.

References (2)

Source: zdi-disclosures@trendmicro.com
ExploitThird Party Advisory
Source: zdi-disclosures@trendmicro.com
ExploitThird Party Advisory

Timeline

No history available yet.