CVE-2026-94094

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.9.6

Description A flaw in the Canvas Host Route component allows a remote attacker to cause a denial of service. The issue exists in the createCanvasHostHandler() function within the extensions/canvas/src/host/server.ts file. The problem occurs because the system buffers the entire file using readFile() instead of implementing a size limit, unlike the WebSocket path which is capped at 64KB.

Recommendations Update OpenClaw to a version newer than 2026.9.5. As a temporary mitigation, restrict access to the createCanvasHostHandler() function.