CVE-2026-3690

CVE-2026-3690 is an authentication bypass vulnerability affecting OpenClaw Canvas endpoints that allows remote attackers to completely circumvent authentication controls without requiring any user interaction or credentials. The flaw stems from improper implementation of the authentication function for canvas endpoints, enabling unauthenticated access to protected systems. This vulnerability was previously tracked as ZDI-CAN-29311. The vulnerability carries a CVSS score of 7.4 (HIGH) with a network-based attack vector requiring only high complexity to execute. It poses significant risk through confidentiality and integrity impacts, as authenticated access enables attackers to view and modify sensitive data. However, the vulnerability does not impact system availability. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists. The EPSS score of 0.0016 indicates minimal exploitation likelihood in the immediate future compared to other disclosed vulnerabilities. Community attention appears limited at present, though organizations running affected OpenClaw installations should prioritize patching due to the authentication bypass nature of the flaw.