OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch
Published Mar 19, 2026 · Updated Oct 23, 2026 · Also known as GHSA-8j2w-6fmm-m587
Original summary
Normalized public record · Updated Oct 23, 2026
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
Gateway auth for plugin channel endpoints can be bypassed when path canonicalization differs between the gateway guard and plugin handler routing.
Potential impact
Authentication boundary bypass for plugin channel HTTP routes under canonicalization mismatch conditions. Unauthorized callers may access plugin channel APIs that are expected to require gateway auth. CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel) CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Base 5.3, Moderate)
Technical context
On affected versions, server-http only applies gateway auth when raw requestPath matches exactly: - /api/channels - /api/channels/ If a plugin handler canonicalizes path input (for example decodeURIComponent(pathname).toLowerCase()), requests like: - /API/channels/nostr/default/profile - /api/channels%2Fnostr%2Fdefault%2Fprofile can be interpreted as /api/channels/ by the plugin, while the gateway auth guard is skipped.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- GHSA-8j2w-6fmm-m587
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- Security advisory ↗
- VulnCheck Advisory: OpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gateway ↗
Record history
Published Mar 19, 2026 · Last refreshed Oct 23, 2026