CVE-2026-3690
Openclaw ≤ 2026.2.19
Raw vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2026-3690 is a high-severity Reliance on IP Address for Authentication (CWE-291) vulnerability in Openclaw Openclaw. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Trusted Relationship (T1199); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-8 (Identification and Authentication (Non-organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21622
Vulnerability Data
OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the the authentication function for canvas…
more
endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of users rather than permitting unauthenticated or spoofable attributes such as source IP.
Requires unique identification and authentication of non-organizational users, precluding reliance on IP address alone.
Mandates documented usage restrictions and configuration requirements for remote access that cannot be satisfied by IP-based authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly replace reliance on spoofable IP addresses.
Managed identities and credentials supplant weak IP-based authentication decisions.
Network monitoring can detect misuse of IP authentication but does not prevent the weakness.
Authorization policies and least privilege reduce dependence on network-location assertions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-authentication control directly addresses the weakness by requiring proper credentials instead of IP address.
Access-control policy can mandate stronger authentication than IP address alone.
Identity-management processes should replace IP-based identification with verified identities.
Authentication-information rules discourage reliance on mutable attributes such as IP addresses.
Access-rights assignment should be tied to authenticated identities, not network location.
Privileged-access rules require authenticated users rather than implicit IP trust.