Insufficient Session Expiration in OpenClaw - CVE-2026-100554
Published: November 3, 2026
Vulnerability identifier: #VU158804
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100554
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to retain unauthorized access to Canvas resources after node revocation, potentially reading or modifying data within the previously granted capability's scope.
The vulnerability exists due to insufficient session expiration in OpenClaw's Canvas HTTP authorization when a paired node is revoked during WebSocket disconnection. A remote user can continue sending HTTP requests using the previously granted Canvas capability, which remains accepted and renewable until connection cleanup finishes, to access resources after authorization has been revoked.
Access is limited to the capability's configured routes and the short WebSocket close grace period.
Affected software
OpenClaw
How to mitigate CVE-2026-100554
Install security update from vendor's website.
OpenClaw - update to 2026.8.1