CVE-2026-32031
MEDIUMOpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gateway
Title source: cnaDescription
OpenClaw versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability in gateway authentication for plugin channel endpoints due to path canonicalization mismatch between the gateway guard and plugin handler routing. Attackers can bypass authentication by sending requests with alternative path encodings to access protected plugin channel APIs without proper gateway authentication.
References (2)
Core 2
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-8j2w-6fmm-m587)
https://github.com/openclaw/openclaw/security/advisories/GHSA-8j2w-6fmm-m587
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gateway
https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-path-canonicalization-mismatch-in-api-channels-gateway
Scores
CVSS v3
4.8
EPSS
0.0019
EPSS Percentile
9.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-288
Status
published
Products (4)
npm/openclaw
0 - 2026.2.26npm
OpenClaw/OpenClaw
< 2026.2.26
openclaw/openclaw
< 2026.2.26
OpenClaw/OpenClaw
2026.2.26
Published
Mar 19, 2026
Tracked Since
Mar 20, 2026