Vulnerability

CVE-2026-100554

Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.

Sharing: PUBLIC-OSINT
Confidence: 100
Source: The CVE Program
Updated: 26/09/2026 08:14

Description

OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability until WebSocket close cleanup completes. As a result, a revoked paired node can continue exercising its Canvas capability against the capability's configured routes during the close grace period. The issue is fixed in 2026.8.1; as a workaround, restart the Gateway after revoking a node that has Canvas access.

STIX identifiervulnerability--cab5e607-9106-5ba8-a9fd-51273edc1886

First observation-

Last observation-

Known relationships6

Aliases and classifications

CWE-613Insufficient Session Expiration

Minimised technical details

No raw data

cisa kev: False
cvss score: 4.2
cvss vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
cvss severity: MEDIUM

Provenance

Public references

VulnCheck Advisory: OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-canvas-capability-revocation-bypass
GitHub Security Advisory (GHSA-g697-vv6h-r8hv)
https://github.com/openclaw/openclaw/security/advisories/GHSA-g697-vv6h-r8hv

EudorIA correlation

Intel catalogue

The vulnerability is also available in the EudorIA editorial catalogue.

Open EudorIA analysis

Presence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.