PT-2026-25475 · Npm · Openclaw

Published 2026-03-03 · Updated 2026-03-03

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Summary

Gateway plugin route auth protection for /api/channels could be bypassed using encoded dot-segment traversal (for example ..%2f) in path variants that plugin handlers normalize.

Affected Packages / Versions

• Package: npm openclaw
• Latest published vulnerable version: 2026.2.25
• Vulnerable version range: <= 2026.2.25
• Patched version: 2026.2.26 (planned next release)

Impact

Under affected versions, crafted alternate paths could bypass gateway auth checks for protected plugin channel routes when plugin handlers decode/canonicalize the incoming path and then route to /api/channels/... handlers.

Fix Commit(s)

• 258d615c45527ffda37cecd08cd268f97461bde0

Release Process Note

patched versions is pre-set to the planned next release (2026.2.26). After npm publish, maintainers only need to publish the advisory.

OpenClaw thanks @zpbrent for reporting.

Fix

Path traversal

Weakness Enumeration

CWE-289

CWE-22

Related Identifiers

GHSA-MWXV-35WR-4VVJ

Affected Products

Openclaw

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-32036 · Security Note
• https://osv.dev/vulnerability/GHSA-mwxv-35wr-4vvj · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/258d615c45527ffda37cecd08cd268f97461bde0 · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mwxv-35wr-4vvj · Note
• https://vulncheck.com/advisories/openclaw-authentication-bypass-via-encoded-dot-segment-traversal-in-api-channels · Note