https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T15:34:43.254888+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-32036 CVE-2026-32036 — OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels 2026-09-28T15:34:43.257330+00:00

Affected: OpenClaw

OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded traversal patterns to access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls.

 https://vulnerability.circl.lu/vuln/ghsa-mwxv-35wr-4vvj GHSA-mwxv-35wr-4vvj — OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths 2026-09-28T15:34:43.257389+00:00

Affected: npm: openclaw

### Summary Gateway plugin route auth protection for `/api/channels` could be bypassed using encoded dot-segment traversal (for example `..%2f`) in path variants that plugin handlers normalize.

### Affected Packages / Versions - Package: npm `openclaw` - Latest published vulnerable version: `2026.2.25` - Vulnerable version range: `<= 2026.2.25` - Patched version: `2026.2.26` (planned next release)

### Impact Under affected versions, crafted alternate paths could bypass gateway auth checks for protected plugin channel routes when plugin handlers decode/canonicalize the incoming path and then route to `/api/channels/...` handlers.

### Fix Commit(s) - `258d615c45527ffda37cecd08cd268f97461bde0`

### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish, maintainers only need to publish the advisory.

OpenClaw thanks @zpbrent for reporting.