AI agent vulnerability · OpenClaw

CVE-2026-32031: OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch

mediumCVSS 4.0 6.3 · 3.1 4.8GHSA-8j2w-6fmm-m587

Summary Gateway auth for plugin channel endpoints can be bypassed when path canonicalization differs between the gateway guard and plugin handler routing. Details On affected versions, server-http only applies gateway auth when raw requestPath matches exactly: - /api/channels - /api/channels/ If a plugin handler canonicalizes path input (for example decodeURIComponent(pathname).toLowerCase()), requests like: -…

Published Mar 12, 2026 · Updated Mar 25, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: <= 2026.2.25
Fixed in: 2026.2.26
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Gateway auth for plugin channel endpoints can be bypassed when path canonicalization differs between the gateway guard and plugin handler routing.

Details

On affected versions, server-http only applies gateway auth when raw requestPath matches exactly:

/api/channels
/api/channels/*

If a plugin handler canonicalizes path input (for example decodeURIComponent(pathname).toLowerCase()), requests like:

/API/channels/nostr/default/profile
/api/channels%2Fnostr%2Fdefault%2Fprofile

can be interpreted as /api/channels/* by the plugin, while the gateway auth guard is skipped.

Impact

Authentication boundary bypass for plugin channel HTTP routes under canonicalization mismatch conditions. Unauthorized callers may access plugin channel APIs that are expected to require gateway auth.

CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel) CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Base 5.3, Moderate)

Credited to tdjackey.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries