CVE-2026-100554 OpenClaw CVE debrief

Who should care

Defenders responsible for OpenClaw deployments should assess exposure and prioritize remediation. They should verify node revocation and Canvas capability invalidation in their OpenClaw deployments. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-100554 is a low-severity vulnerability in OpenClaw that allows a revoked paired node to continue exercising its Canvas capability during a close grace period. Defenders should prioritize verifying node revocation and Canvas capability invalidation in their OpenClaw deployments.

• Verification of node revocation and Canvas capability invalidation is required to prevent unauthorized access.
• Restarting Gateway after revoking a node with Canvas access may be necessary to immediately invalidate Canvas HTTP authorization.

Technical summary

The OpenClaw npm package versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. This allows a revoked paired node to continue exercising its Canvas capability against configured routes during a close grace period. The issue is fixed in version 2026.8.1; as a workaround, restart the Gateway after revoking a node that has Canvas access. Defenders should prioritize verifying node revocation and Canvas capability invalidation in their OpenClaw deployments.

Defensive priority

Defenders should prioritize verifying node revocation and Canvas capability invalidation in their OpenClaw deployments.

Recommended defensive actions

• Verify OpenClaw node revocation and Canvas capability invalidation
• Restart Gateway after revoking a node with Canvas access
• Assess exposure and prioritize remediation for OpenClaw deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited. Further verification is required to determine affected versions and remediation. The OpenClaw npm package's affected versions are >= 2026.5.12 and < 2026.8.1. Defenders should verify node revocation and Canvas capability invalidation in their OpenClaw deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.