CVE-2026-100554

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

EUVD-2026-87496

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

CVE-2026-100554: Insufficient Session Expiration

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

PT-2026-99191

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.12 through 2026.8.0 Description When a paired node is revoked, the system fails to immediately invalidate Canvas HTTP authorization. While the WebSocket client is invalidated, the Canvas HTTP authorization continues to...