| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.2.26 | 2026.2.26 |
| openclaw | < 2026.2.26 | 2026.2.26 |
Gateway auth for plugin channel endpoints can be bypassed when path canonicalization differs between the gateway guard and plugin handler routing.
On affected versions, server-http only applies gateway auth when raw requestPath matches exactly:
/api/channels/api/channels/*If a plugin handler canonicalizes path input (for example decodeURIComponent(pathname).toLowerCase()), requests like:
/API/channels/nostr/default/profile/api/channels%2Fnostr%2Fdefault%2Fprofile
can be interpreted as /api/channels/* by the plugin, while the gateway auth guard is skipped.Authentication boundary bypass for plugin channel HTTP routes under canonicalization mismatch conditions. Unauthorized callers may access plugin channel APIs that are expected to require gateway auth.
CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Base 5.3, Moderate)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free