CVE-2026-3689 OpenClaw Canvas Path Traversal Information Disclosure Vulnerability

Medium 6.5 Published 11 Apr 2026 Updated 13 Apr 2026

Authenticated attackers can exploit path traversal in the canvas gateway to disclose sensitive information via file operations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-3689?

CVE-2026-3689 is a medium-severity path traversal vulnerability in Openclaw Openclaw, published on 11 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenClaw. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of the path parameters provided to the canvas gateway endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-29312.

Weakness: CWE-22

Which versions are affected by CVE-2026-3689?

2 open source packages ship an affected version, including openclaw. It affects 1 product.

Package	Affected	Fixed in
`openclaw` npm	All versions	`2026.2.21`
`openclaw` npm	All versions	`2026.2.21`

Products include Openclaw Openclaw.

How do I fix CVE-2026-3689?

Upgrade openclaw to 2026.2.21 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-3689 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3689 exists.

All Openclaw Openclaw vulnerabilities

Sources

Also known as GHSA-jq4x-98m3-ggq6, GHSA-xq39-5c6m-mcq7, MINI-98w9-cfmx-jw54, MINI-gr9m-vpj7-24j7.