GitHub Advisoryadvisory · npm

GHSA-mwxv-35wr-4vvj OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths

HIGH Published 2026-03-03 Modified 2026-03-20 Official page ↗
Aliases
CVE-2026-32036
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-22, CWE-289
Reviewed
2026-03-03

Affected packages

• npm openclaw: < 2026.2.26 → fixed in 2026.2.26

Description

Summary Gateway plugin route auth protection for `/api/channels` could be bypassed using encoded dot-segment traversal (for example `..%2f`) in path variants that plugin handlers normalize. Affected Packages / Versions • Package: npm `openclaw` • Latest published vulnerable version: `2026.2.25` • Vulnerable version range: `<= 2026.2.25` • Patched version: `2026.2.26` (planned next release) Impact Under affected versions, crafted alternate paths could bypass gateway auth checks for protected plugin channel routes when plugin handlers decode/canonicalize the incoming path and then route to `/api/channels/...` handlers. Fix Commit(s) • `258d615c45527ffda37cecd08cd268f97461bde0` Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish, maintainers only need to publish the advisory. OpenClaw thanks @zpbrent for reporting.

Related

Alias · CVE (1)

  • CVE-2026-32036 OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-289 Authentication Bypass by Alternate Name weakness

References