OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths

Summary

Gateway plugin route auth protection for /api/channels could be bypassed using encoded dot-segment traversal (for example ..%2f) in path variants that plugin handlers normalize.

Affected Packages / Versions

• Package: npm openclaw
• Latest published vulnerable version: 2026.2.25
• Vulnerable version range: <= 2026.2.25
• Patched version: 2026.2.26 (planned next release)

Impact

Under affected versions, crafted alternate paths could bypass gateway auth checks for protected plugin channel routes when plugin handlers decode/canonicalize the incoming path and then route to /api/channels/... handlers.

Fix Commit(s)

• 258d615c45527ffda37cecd08cd268f97461bde0

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.26). After npm publish, maintainers only need to publish the advisory.

OpenClaw thanks @zpbrent for reporting.