Medium
OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
Type: advisorySource: Official CVE List
OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canva…
Products: OpenClawCVEs: CVE-2026-100554