PT-2026-26412 · Openclaw · Openclaw

Tdjackey · Published 2026-03-12 · Updated 2026-03-20 · CVE-2026-32031

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.26

Description The server-http component of OpenClaw contains an authentication bypass in gateway authentication for plugin channel endpoints. This is due to a path canonicalization mismatch between the gateway guard and plugin handler routing. Attackers can bypass authentication by sending requests with alternative path encodings to access protected plugin channel APIs without proper gateway authentication. Specifically, the server-http component applies gateway authentication only when the raw requestPath matches exactly, such as '/api/channels' or '/api/channels/'. If a plugin handler canonicalizes the path input (for example, using decodeURIComponent(pathname).toLowerCase()), requests like '/API/channels/nostr/default/profile' or '/api/channels%2Fnostr%2Fdefault%2Fprofile' can be interpreted as '/api/channels/' by the plugin, while the gateway authentication guard is skipped. This allows unauthorized callers to access plugin channel APIs that require gateway authentication.

Recommendations Versions prior to 2026.2.26 should be updated.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-32031

GHSA-8J2W-6FMM-M587

Affected Products

Openclaw

References · 6

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8j2w-6fmm-m587 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8j2w-6fmm-m587 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32031 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2034891585876357380 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authentication-bypass-via-path-canonicalization-mismatch-in-api-channels-gateway · Note