Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-94094

OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service

CVSS 4.0 5.3 MEDIUMCVSS 3.1 4.3 MEDIUMCVSS 3.0 4.3 MEDIUMCVSS 2.0 4.0 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-94094

Published

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-94094

Published

OpenClaw

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "n/a",
                    "product": "OpenClaw",
                    "versions": [
                        {
                            "version": "2026.9.0",
                            "status": "affected"
                        },
                        {
                            "version": "2026.9.1",
                            "status": "affected"
                        },
                        {
                            "version": "2026.9.2",
                            "status": "affected"
                        },
                        {
                            "version": "2026.9.3",
                            "status": "affected"
                        },
                        {
                            "version": "2026.9.4",
                            "status": "affected"
                        },
                        {
                            "version": "2026.9.5",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Canvas Host Route"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON