A vulnerability, which was classified as critical, was found in OpenClaw up to 2026.3.22. The impacted element is the function
authorizeCanvasRequest. Such manipulation leads to authentication bypass using alternate channel.
This vulnerability is uniquely identified as CVE-2026-35634. Local access is required to approach this attack. No exploit exists.
You should upgrade the affected component.
