Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenClaw. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the path parameters provided to the canvas gateway endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-29312.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-30 | 1 | Disclosure1 |
| 2026-04-19 | 1 | General1 |
CVE-2026-3689 OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installati… https://www.cve.org/CVERecord?id=CVE-2026-3689
Post summary
The excerpt provides a concise CVE description stating a path traversal data disclosure flaw in OpenClaw Canvas, but lacks details on exploitation, patches, or real‑world attacks.
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability (CVE-2026-3689) #CVE20263689 #CyberSecurity #InformationDisclosureVulnerability #OpenClaw https://www.systemtek.co.uk/?p=48947 https://t.co/JdpE64M4LD
Post summary
A new path traversal information disclosure flaw, CVE-2026-3689, has been announced for OpenClaw Canvas, with no PoC, exploit, or patch detail provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |