GHSA-6mqc-jqh6-x8fc: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication

March 26, 2026 (updated April 9, 2026)

Before v2026.3.23, Canvas and A2UI loopback requests could bypass Canvas bearer-or-capability authentication because authorizeCanvasRequest(...) treated isLocalDirectRequest(...) as an unconditional allow path.

References

github.com/advisories/GHSA-6mqc-jqh6-x8fc
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/d5dc6b6573ae489bc7e5651090f4767b93537c9e
github.com/openclaw/openclaw/security/advisories/GHSA-6mqc-jqh6-x8fc

Code Behaviors & Features

Detect and mitigate GHSA-6mqc-jqh6-x8fc with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →