Dashboard / CVE-2026-3690

CVE-2026-3690

HIGH
MEDIUM Priority: 0.06 BB Relevance: 65/100
Published: 2026-04-11 Modified: 2026-11-11 First seen: 2026-11-11 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: High
I: High
A: None

Description

OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
openclaw openclaw < 2026.2.19

References & Advisories (2)

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

7.4 / 10.0 v3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploitation Probability

0.84%
Raw Score 0.008430
Percentile 58.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00843
2026-11-12
0.00843
2026-11-10
0.00843

Intelligence Sources

nvd ref →

External Links