CVE-2026-94094: OpenClaw Canvas Host DOS Vulnerability

CVE-2026-94094 Overview

CVE-2026-94094 is a denial of service vulnerability in OpenClaw versions up to 2026.9.5. The flaw exists in the createCanvasHostHandler function of extensions/canvas/src/host/server.ts within the Canvas Host Route component. An authenticated remote attacker can trigger resource exhaustion by submitting large requests that the handler buffers entirely into memory. The vendor's proposed streaming/size-limit fix was never shipped, and version 2026.9.5 still buffers the entire file via readFile() at src/canvas/serve.runtime.ts:17,114. The sibling WebSocket path correctly caps input at 64KB, while the HTTP handler does not. A public exploit has been published.

Critical Impact
Remote authenticated attackers can exhaust server memory by sending oversized requests to the Canvas Host Route, causing denial of service.

Affected Products

OpenClaw up to and including version 2026.9.5
Canvas Host Route component (extensions/canvas/src/host/server.ts)
Canvas runtime serving path (src/canvas/serve.runtime.ts)

Discovery Timeline

2026-09-20 - CVE-2026-94094 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94094

Vulnerability Analysis

The vulnerability falls under improper resource shutdown or release [CWE-404]. The createCanvasHostHandler function processes incoming HTTP requests to the Canvas Host Route without enforcing a size boundary. The handler invokes readFile() to load request payloads into memory in a single buffered read. Large GET requests therefore consume memory proportional to the payload size until the process is starved of resources.

The inconsistency is notable: the parallel WebSocket code path already enforces a 64KB cap on inbound data. The HTTP handler was expected to adopt the same streaming/size-limit control, but that mitigation never reached the 2026.9.5 release. As a result, the disclosed exploit remains viable against the latest build.

Root Cause

The root cause is missing input size validation combined with fully-buffered file reads in the Canvas Host request pipeline. Because readFile() returns the entire payload before any downstream processing, the server cannot reject oversized requests early or stream them to disk. There is no request-body cap, no timeout guard, and no back-pressure mechanism on the HTTP route.

Attack Vector

The attack is network-based and requires low privileges but no user interaction. An authenticated remote attacker sends a large HTTP GET request to the Canvas Host endpoint. The handler buffers the payload in memory, and repeated or sufficiently large requests exhaust the Node.js process heap, degrading or halting service availability. Technical details and reproduction steps are documented in the OpenClaw Canvas Big GET DoS Report.

Detection Methods for CVE-2026-94094

Indicators of Compromise

Sudden growth in Node.js process resident set size (RSS) tied to Canvas Host traffic
HTTP GET requests to Canvas Host routes with abnormally large query strings or bodies
Repeated readFile() invocations logged against src/canvas/serve.runtime.ts prior to process crashes
Out-of-memory (OOM) terminations of the OpenClaw runtime process

Detection Strategies

Alert on HTTP requests exceeding a defined byte threshold reaching Canvas Host endpoints
Correlate spikes in inbound request size with subsequent process restarts or health-check failures
Baseline memory consumption of the OpenClaw runtime and flag deviations exceeding two standard deviations

Monitoring Recommendations

Enable request-size logging at the reverse proxy or WAF layer in front of OpenClaw
Instrument the Canvas Host route with per-request memory allocation metrics
Track authenticated session identifiers issuing repeated large payloads to the Canvas Host

How to Mitigate CVE-2026-94094

Immediate Actions Required

Place a reverse proxy or WAF in front of OpenClaw and enforce a hard request-body size limit
Restrict authenticated access to the Canvas Host route to trusted users only
Monitor OpenClaw runtime memory and configure automatic restart on OOM conditions to reduce outage duration

Patch Information

No effective vendor patch is available. According to the disclosure, the streaming/size-limit fix suggestion was never shipped, and OpenClaw 2026.9.5 remains vulnerable. Track the VulDB entry for CVE-2026-94094 and the VulDB vulnerability record #408023 for patch status updates.

Workarounds

Terminate HTTP traffic behind a proxy that enforces client_max_body_size or equivalent request-size limits
Mirror the WebSocket path's 64KB cap by rejecting Canvas Host requests larger than 64KB at the ingress layer
Rate-limit authenticated requests to the Canvas Host route to reduce sustained memory pressure

bash

# Example nginx configuration to cap request size in front of OpenClaw
http {
    client_max_body_size 64k;
    client_body_buffer_size 64k;

    server {
        listen 443 ssl;
        server_name openclaw.example.com;

        location /canvas/ {
            limit_req zone=canvas_zone burst=5 nodelay;
            proxy_pass http://openclaw_backend;
        }
    }

    limit_req_zone $binary_remote_addr zone=canvas_zone:10m rate=10r/s;
}