What is the CVSS score of CVE-2026-3690?

CVE-2026-3690 has a CVSS 3.0 base score of 7.4 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-3690?

CVE-2026-3690 affects OpenClaw canvas endpoints, allowing unauthenticated remote attackers to bypass authentication controls and access sensitive data or modify system state without credentials.. A patch is available.

How to fix or mitigate CVE-2026-3690?

Within 24 hours: Inventory all OpenClaw deployments and identify canvas endpoint exposure to untrusted networks; document affected versions. Within 7 days: Implement network-level access controls (firewall rules, WAF policies) to restrict canvas endpoints to authorized users/networks only; contact OpenClaw vendor for patch timeline and interim guidance. Within 30 days: Apply vendor-released patch immediately upon availability; if patch unavailable, escalate to vendor for security update or evaluate alternative solutions.

Openclaw CVE-2026-3690

EUVD-2026-21622 HIGH

Reliance on IP Address for Authentication (CWE-291)

2026-04-11 zdi

GHSA-93g8-mgqc-w7h9

Authentication Bypass Openclaw

7.4

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 17:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 11, 2026 - 01:00 euvd

EUVD-2026-21622

Analysis Generated

Apr 11, 2026 - 01:00 vuln.today

CVE Published

Apr 11, 2026 - 00:17 nvd

HIGH 7.4

DescriptionCVE.org

OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311.

AnalysisAI

Unauthenticated remote attackers bypass authentication in OpenClaw canvas endpoints due to improper authentication implementation (CWE-291). Exploitation requires no user interaction and yields high confidentiality/integrity impact. Network-accessible attack vector with high complexity (CVSS:3.0 7.4 AV:N/AC:H/PR:N). No public exploit identified at time of analysis. Originally reported as ZDI-CAN-29311.

Technical ContextAI

Authentication function for canvas endpoints contains implementation flaw allowing authentication mechanism bypass. CWE-291 (Missing Authentication for Critical Function) indicates authentication check absent or incorrectly enforced. CVSS AC:H suggests attack requires specific timing, conditions, or preparation despite network accessibility. Root cause in logic error rather than input validation weakness.

RemediationAI

Apply vendor-released patch per GitHub Security Advisory GHSA-vvjh-f6p9-5vcf at https://github.com/openclaw/openclaw/security/advisories/GHSA-vvjh-f6p9-5vcf. Consult Zero Day Initiative advisory ZDI-26-228 at https://www.zerodayinitiative.com/advisories/ZDI-26-228/ for additional technical details. Released patched version not independently confirmed from provided references. Interim mitigations: restrict network access to canvas endpoints via firewall rules limiting exposure to trusted IP ranges, implement reverse proxy with mandatory authentication layer, disable canvas functionality if not operationally required. Monitor authentication logs for repeated failed canvas endpoint access patterns indicating exploitation attempts.