Executive brief
OpenClaw is a JavaScript application framework with a gateway plugin system that handles API routing. An authentication bypass vulnerability allows attackers to access protected /api/channels endpoints by using URL-encoded path traversal sequences (like ..%2f) that plugin handlers normalize differently than the auth checker expects. This could enable unauthorized access to sensitive channel data or operations without valid authentication credentials.
Technical details
This is an authentication bypass vulnerability (CWE-289) combined with a path traversal element (CWE-22). The gateway plugin's route protection for /api/channels endpoints fails to properly validate canonicalized paths before enforcement; when plugin handlers decode or normalize URLs containing percent-encoded dot-segments (e.g., ..%2f), they produce paths that bypass the auth checks designed to match literal incoming paths. An unauthenticated attacker with network access to the application can craft alternate path variants to access protected endpoints. The vulnerability affects all versions up to 2026.2.25, with a fix planned for version 2026.2.26 (commit 258d615c45527ffda37cecd08cd268f97461bde0).
Affected products
- OpenClaw OpenClaw <= 2026.2.25
Timeline
- 2026-03-03: disclosed: Advisory GHSA-mwxv-35wr-4vvj published
- 2026-02-26: patched: Patched version 2026.2.26 planned (commit 258d615c45527ffda37cecd08cd268f97461bde0)