# OpenClaw Canvas Authentication Bypass Vulnerability

OpenClaw gateway granted canvas endpoint access to any HTTP request sharing a private IP with an authenticated WebSocket client, bypassing token auth.

- Payout: Research
- Severity: high
- Program: OpenClaw
- Found by: zdi-disclosures
- Disclosed: 2026-03-04
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-vvjh-f6p9-5vcf
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-vvjh-f6p9-5vcf
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:websocket technique:source-review vuln:access-control vuln:auth-bypass

**Target:** OpenClaw gateway canvas HTTP/WebSocket endpoints (/__openclaw__/a2ui/, /__openclaw__/canvas/, /__openclaw__/ws)
**Root cause:** authorizeCanvasRequest() falls back to IP-only trust: if any authenticated WebSocket client shares the request's private/loopback source IP, the HTTP request is granted canvas access without its own token. hasAuthorizedWsClientForIp() matches on IP alone, not session or user.
**Steps:**
1. Deploy gateway with `--bind lan` and a token; have a legitimate client connect via WebSocket with a valid token from a shared IP (NAT/container).
2. From another host/container sharing that same source IP, send an HTTP request to `http://gateway:18789/__openclaw__/a2ui/` with no `Authorization` header.
3. authorizeCanvasRequest() sees a private IP with a matching authenticated WS client and returns `{ ok: true }`, yielding 200 OK and full canvas access.
4. Control: same request from a different IP returns 401; with a valid token returns 200.
**How found:** Code review of src/gateway/server-http.ts: noticed canvas paths route through authorizeCanvasRequest() instead of authorizeGatewayConnect(), and that the IP fallback trusts any WS client sharing the source IP rather than binding the HTTP request to that client's session.
**Exploitation:** Attacker needs only network adjacency to a gateway where a legitimate WS client authenticated from the same NAT/VPN/pod IP. No credentials or interaction required; the attacker then reads A2UI rendered content, canvas HTML/JS, and can upgrade the canvas WebSocket.
**Insight:** When an app has both a stateful authenticated channel (WS) and stateless HTTP endpoints, check whether the HTTP side reuses the WS connection's identity attributes like source IP as an auth shortcut — NAT, VPN and pod networking collapse many clients onto one IP, turning that shortcut into a bypass.