N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-cjv3-m589-v3rx

GHSA-cjv3-m589-v3rx: OpenClaw has Canvas route hardening for mixed-trust deployments

Summary

This advisory tracks a defense-in-depth hardening for canvas routes. In mixed-trust or network-visible deployments, prior canvas auth/fallback behavior could broaden access beyond intended boundaries.

Deployment Context

OpenClaw’s default model is trusted host + loopback-first access. Some operators intentionally expose canvas routes on LAN/tailnet. This update is aimed at those broader deployment patterns.

What Changed

Require explicit token or session-capability authorization for canvas routes.
Remove shared-IP fallback paths for canvas access.
Tighten bind/fallback behavior to fail closed.

Impact

Risk was highest in non-loopback or mixed-trust environments. In strict single-operator trusted-host setups, practical exposure is lower.

Affected Packages / Versions

Package: openclaw (npm)
Vulnerable: <= 2026.2.19-2
Patched: 2026.2.21 (next release target)

Fix Commit(s)

c45f3c5b004c8d63dc0e282e2176f8c9355d24f1
08a7967936cfc0b2af6b27ec1f9272542648ad6c

Thanks @NucleiAv for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-cjv3-m589-v3rx

GHSA-cjv3-m589-v3rx:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.21	2026.2.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the authentication mechanism for OpenClaw's canvas routes (/__openclaw__/canvas/* and /__openclaw__/a2ui/*). The system was designed with a trusted-host, loopback-first model. However, for deployments where the canvas is exposed to a wider network, the authentication was insufficient.

The root cause was an IP-based authentication fallback. The authorizeCanvasRequest function would allow access to canvas routes without a token if the request's IP address matched the IP of an already connected and authorized 'node' WebSocket client. This was implemented in the hasAuthorizedNodeWsClientForIp function. An attacker on the same local network, or in any environment where they might share an IP address with a legitimate node client (e.g., behind the same NAT), could send requests to the canvas routes and be granted access, bypassing authentication.

Furthermore, the resolveGatewayClientIp function had a weakness where it could incorrectly identify a request's origin. If a request came from a trusted proxy but was missing the x-forwarded-for header, the function would fall back to using the proxy's own IP as the client IP. This could cause an external request to be treated as local and trusted, exacerbating the issue.

The patches address this by completely removing the IP-based fallback mechanism. The fix, implemented in commit c45f3c5b004c8d63dc0e282e2176f8c9355d24f1, introduces a session-capability token system. Now, an authorized node is given a unique, short-lived capability token (oc_cap) which must be included in all subsequent requests to canvas routes. This ensures that only the client holding the token can access these routes, effectively hardening the authentication and preventing unauthorized access in mixed-trust deployments.

Vulnerable functions

authorizeCanvasRequest

src/gateway/server-http.ts

This function contained flawed logic that allowed an IP-based fallback for authentication. If a request's IP address matched the IP of an already connected and authorized 'node' client, the request was granted access to canvas routes without a token. This could allow an attacker on the same network (or in a shared IP environment) to bypass authentication and access sensitive canvas routes.

hasAuthorizedNodeWsClientForIp

src/gateway/server-http.ts

This function (and its predecessor `hasAuthorizedWsClientForIp`) is the core of the vulnerability. It checks if any connected WebSocket client has the same IP address as the incoming request. If a match is found, it returns true, leading `authorizeCanvasRequest` to grant access. The vulnerability is that it assumes any request from that IP is from the authorized client, which is not safe in mixed-trust or shared-IP environments.

resolveGatewayClientIp

src/gateway/net.ts

The original implementation of this function could fall back to the remote address (the proxy's IP) if forwarded-for headers were missing. This could cause a request from a trusted proxy to be misidentified as a local/trusted request, contributing to the authentication bypass in `authorizeCanvasRequest`.

createGatewayHttpServer

src/gateway/server-http.ts

This function is the entry point for handling HTTP requests to the gateway. For requests to canvas paths, it calls the vulnerable `authorizeCanvasRequest` function, placing it in the execution path of the exploit.

attachGatewayUpgradeHandler

src/gateway/server-http.ts

This function handles WebSocket upgrade requests. For WebSocket connections to the canvas, it calls the vulnerable `authorizeCanvasRequest` function, placing it in the execution path of the exploit for WebSocket-based attacks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-cjv3-m589-v3rx: OpenClaw has Canvas route hardening for mixed-trust deployments

Summary

Deployment Context

What Changed

Impact

Affected Packages / Versions

Fix Commit(s)

GHSA-cjv3-m589-v3rx:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

N/A

N/A

GHSA-cjv3-m589-v3rx: OpenClaw has Canvas route hardening for mixed-trust deployments

Summary

Deployment Context

What Changed

Impact

Affected Packages / Versions

Fix Commit(s)

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI