GHSA-8j2w-6fmm-m587 OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch

• npm openclaw: < 2026.2.26 → fixed in 2026.2.26

Summary Gateway auth for plugin channel endpoints can be bypassed when path canonicalization differs between the gateway guard and plugin handler routing. Details On affected versions, `server-http` only applies gateway auth when raw `requestPath` matches exactly: • `/api/channels` • `/api/channels/*` If a plugin handler canonicalizes path input (for example `decodeURIComponent(pathname).toLowerCase()`), requests like: • `/API/channels/nostr/default/profile` • `/api/channels%2Fnostr%2Fdefault%2Fprofile` can be interpreted as `/api/channels/*` by the plugin, while the gateway auth guard is skipped. Impact Authentication boundary bypass for plugin channel HTTP routes under canonicalization mismatch conditions. Unauthorized callers may access plugin channel APIs that are expected to require gateway auth. CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel) CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N` (Base 5.3, Moderate)