CVE-2026-94094 in OpenClaw
Summary
by MITRE • 09/21/2026
A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in OpenClaw versions up to 2026.9.5 represents a critical resource exhaustion flaw within the Canvas Host Route component, specifically located in the createCanvasHostHandler function found in extensions/canvas/src/host/server.ts. This issue stems from an improper handling of input data size during file processing operations. While the WebSocket path for canvas interactions correctly implements a 64KB buffer limit to prevent excessive memory consumption, the HTTP-based server route fails to apply similar constraints. Instead of streaming or limiting the input size, the implementation utilizes readFile() in src/canvas/serve.runtime.ts at line 17 column 114 to load the entire file content into memory simultaneously. This architectural inconsistency creates a significant disparity in security posture between different communication channels within the same application component, leaving one path vulnerable while the other remains protected by design limits.
From a technical perspective, this flaw constitutes an uncontrolled resource consumption vulnerability that directly leads to denial of service conditions. When an attacker submits a request with a large payload or a specially crafted file through the affected HTTP endpoint, the server attempts to allocate memory for the entire content in a single operation. Because there is no upper bound on the size of data read into RAM, repeated requests or even a single sufficiently large request can exhaust available system memory. This results in the application becoming unresponsive as it struggles with garbage collection overhead or crashes entirely due out-of-memory errors. The vulnerability allows for remote exploitation without requiring authentication, meaning any external actor capable of sending HTTP requests to the OpenClaw instance can trigger this condition.
The operational impact of this denial of service vector is severe, particularly in production environments where availability is paramount. Since the exploit has been published and is known to be functional, automated scanning tools or malicious actors actively seeking out vulnerable instances are likely attempting to leverage this flaw. A successful attack does not necessarily result in data breach or remote code execution but rather renders the service unavailable to legitimate users. In cloud-native deployments where resources may be auto-scaled based on memory pressure, such attacks can trigger unnecessary scaling events leading to increased costs and potential cascading failures across dependent services that rely on OpenClaw for canvas rendering operations.
This vulnerability aligns with CWE-400 Uncontrolled Resource Consumption, as the application fails to restrict the amount of resources consumed by a single request. It also maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service: Overhead Limits Exhaustion, where attackers exploit resource limits such as memory or CPU time to degrade service availability. The fact that the vendor was contacted early regarding this disclosure highlights the importance of proactive vulnerability management and responsible disclosure practices. However, the persistence of the flaw in version 2026.9.5 indicates a gap between reported issues and deployed fixes, emphasizing the need for rigorous regression testing after patching cycles to ensure that intended mitigations like streaming or size limits are correctly implemented across all code paths.
To mitigate this risk immediately, organizations should implement network-level controls such as web application firewalls with strict payload size restrictions on canvas-related endpoints. Setting a maximum request body limit significantly lower than the system memory capacity can prevent the initial trigger of the vulnerability until an official patch is applied. Additionally, monitoring for unusually large HTTP POST requests to canvas host routes can aid in early detection and blocking of exploitation attempts. It is crucial that administrators verify whether their deployment includes any custom overrides or configurations that might inadvertently disable existing safety mechanisms. Until a verified fix is released by OpenClaw maintainers, treating the Canvas Host Route as untrusted input space and enforcing strict size limits at the infrastructure layer remains the most effective defense strategy against this remote denial of service vector.