https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:08:12 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32004 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitting deeply encoded slash variants such as multi-encoded %2f to access protected /api/channels endpoints.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitting deeply encoded slash variants such as multi-encoded %2f to access protected /api/channels endpoints.</p> https://vulnerability.circl.lu/vuln/cve-2026-32004 https://vulnerability.circl.lu/vuln/ghsa-v865-p3gq-hw6m <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary (Updated March 2, 2026) Encoded alternate-path requests could bypass plugin route auth checks for `/api/channels/*` due to canonicalization depth mismatch in vulnerable builds.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published vulnerable version: `2026.3.1` - Affected range: `&lt;= 2026.3.1` - Patched release: `2026.3.2` (`patched_versions: &gt;= 2026.3.2`)</p> <p>### Technical Details In affected versions, plugin auth-path classification and route-path canonicalization could diverge for deeply encoded slash variants (for example multi-encoded `%2f`). That mismatch allowed alternate encoded paths to evade protected-prefix auth checks while still resolving to `/api/channels/...` in plugin route handling.</p> <p>The fix set hardens this class of issue by: - canonicalizing route paths to a bounded fixpoint, - failing closed on malformed or unresolved canonicalization depth, - requiring explicit plugin-route auth contracts (no implicit auth default), - enforcing route ownership/conflict guards for duplicate route registrations, and - using shared webhook route lifecycle registration to avoid stale/conflicting route surfaces.</p> <p>### Affected Deployments Deployments exposing plugin HTTP routes and relying on gateway auth for `/api/channels/*` protection.</p> <p>### Fix Commit(s) - `93b07240257919f770d1e263e1f22753937b80ea` - `2fd8264ab03bd178e62a5f0c50d1c8556c17f12d` - `d74bc257d8432f17e50b23ae713d7e0623a1fe0f` - `7a7eee920a176a0043398c6b37bf4cc6eb983eeb`</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary (Updated March 2, 2026) Encoded alternate-path requests could bypass plugin route auth checks for `/api/channels/*` due to canonicalization depth mismatch in vulnerable builds.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published vulnerable version: `2026.3.1` - Affected range: `&lt;= 2026.3.1` - Patched release: `2026.3.2` (`patched_versions: &gt;= 2026.3.2`)</p> <p>### Technical Details In affected versions, plugin auth-path classification and route-path canonicalization could diverge for deeply encoded slash variants (for example multi-encoded `%2f`). That mismatch allowed alternate encoded paths to evade protected-prefix auth checks while still resolving to `/api/channels/...` in plugin route handling.</p> <p>The fix set hardens this class of issue by: - canonicalizing route paths to a bounded fixpoint, - failing closed on malformed or unresolved canonicalization depth, - requiring explicit plugin-route auth contracts (no implicit auth default), - enforcing route ownership/conflict guards for duplicate route registrations, and - using shared webhook route lifecycle registration to avoid stale/conflicting route surfaces.</p> <p>### Affected Deployments Deployments exposing plugin HTTP routes and relying on gateway auth for `/api/channels/*` protection.</p> <p>### Fix Commit(s) - `93b07240257919f770d1e263e1f22753937b80ea` - `2fd8264ab03bd178e62a5f0c50d1c8556c17f12d` - `d74bc257d8432f17e50b23ae713d7e0623a1fe0f` - `7a7eee920a176a0043398c6b37bf4cc6eb983eeb`</p> https://vulnerability.circl.lu/vuln/ghsa-v865-p3gq-hw6m