https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T14:08:12.362473+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-32004 CVE-2026-32004 — OpenClaw < 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Route 2026-09-28T14:08:14.816982+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitting deeply encoded slash variants such as multi-encoded %2f to access protected /api/channels endpoints.

 https://vulnerability.circl.lu/vuln/ghsa-v865-p3gq-hw6m GHSA-v865-p3gq-hw6m — OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification 2026-09-28T14:08:14.817549+00:00

Affected: npm: openclaw

### Summary (Updated March 2, 2026) Encoded alternate-path requests could bypass plugin route auth checks for `/api/channels/*` due to canonicalization depth mismatch in vulnerable builds.

### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published vulnerable version: `2026.3.1` - Affected range: `<= 2026.3.1` - Patched release: `2026.3.2` (`patched_versions: >= 2026.3.2`)

### Technical Details In affected versions, plugin auth-path classification and route-path canonicalization could diverge for deeply encoded slash variants (for example multi-encoded `%2f`). That mismatch allowed alternate encoded paths to evade protected-prefix auth checks while still resolving to `/api/channels/...` in plugin route handling.

The fix set hardens this class of issue by: - canonicalizing route paths to a bounded fixpoint, - failing closed on malformed or unresolved canonicalization depth, - requiring explicit plugin-route auth contracts (no implicit auth default), - enforcing route ownership/conflict guards for duplicate route registrations, and - using shared webhook route lifecycle registration to avoid stale/conflicting route surfaces.

### Affected Deployments Deployments exposing plugin HTTP routes and relying on gateway auth for `/api/channels/*` protection.

### Fix Commit(s) - `93b07240257919f770d1e263e1f22753937b80ea` - `2fd8264ab03bd178e62a5f0c50d1c8556c17f12d` - `d74bc257d8432f17e50b23ae713d7e0623a1fe0f` - `7a7eee920a176a0043398c6b37bf4cc6eb983eeb`