N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-v865-p3gq-hw6m

GHSA-v865-p3gq-hw6m: OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification

Summary (Updated March 2, 2026)

Encoded alternate-path requests could bypass plugin route auth checks for /api/channels/* due to canonicalization depth mismatch in vulnerable builds.

Affected Packages / Versions

Package: openclaw (npm)
Latest published vulnerable version: 2026.3.1
Affected range: <= 2026.3.1
Patched release: 2026.3.2 (patched_versions: >= 2026.3.2)

Technical Details

In affected versions, plugin auth-path classification and route-path canonicalization could diverge for deeply encoded slash variants (for example multi-encoded %2f). That mismatch allowed alternate encoded paths to evade protected-prefix auth checks while still resolving to /api/channels/... in plugin route handling.

The fix set hardens this class of issue by:

canonicalizing route paths to a bounded fixpoint,
failing closed on malformed or unresolved canonicalization depth,
requiring explicit plugin-route auth contracts (no implicit auth default),
enforcing route ownership/conflict guards for duplicate route registrations, and
using shared webhook route lifecycle registration to avoid stale/conflicting route surfaces.

Affected Deployments

Deployments exposing plugin HTTP routes and relying on gateway auth for /api/channels/* protection.

Fix Commit(s)

93b07240257919f770d1e263e1f22753937b80ea
2fd8264ab03bd178e62a5f0c50d1c8556c17f12d
d74bc257d8432f17e50b23ae713d7e0623a1fe0f
7a7eee920a176a0043398c6b37bf4cc6eb983eeb

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-v865-p3gq-hw6m

GHSA-v865-p3gq-hw6m:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.1	2026.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass due to a flaw in URL path canonicalization. Attackers could send requests with multiple layers of URL encoding (e.g., %252f for /) to protected endpoints like /api/channels. The buildCanonicalPathCandidates function had a shallow decoding depth (3 passes) and would fail to fully decode these paths. Consequently, the isPathProtectedByPrefixes function would not recognize the path as a protected route, allowing the request to bypass authentication checks within createGatewayHttpServer. The patch addresses this by increasing the decoding depth, adding a mechanism to detect incomplete canonicalization (decodePassLimitReached), and ensuring that any path that cannot be fully canonicalized is treated as a protected route by default ('fail-closed'). Subsequent commits further harden the system by removing ambiguous wildcard route handlers and requiring all plugin routes to explicitly declare their authentication requirements, reducing the risk of similar vulnerabilities.

Vulnerable functions

buildCanonicalPathCandidates

src/gateway/security-path.ts

This function was responsible for decoding URL-encoded paths. It had a low decoding depth limit (`MAX_PATH_DECODE_PASSES = 3`) and did not signal when a path was not fully decoded. This allowed an attacker to bypass authentication by using more than three layers of URL encoding on a protected path like `/api/channels`, as the function would return a partially-decoded path that did not match any protected patterns.

isPathProtectedByPrefixes

src/gateway/security-path.ts

This function checks if a given path matches a list of protected prefixes. It was vulnerable because it relied on the output of the canonicalization function which did not handle deeply nested encoded characters. It did not account for paths that were not fully decoded due to excessive encoding depth. The patch makes it "fail closed" by treating any path that hits the decoding limit as protected, thus preventing the bypass.

isProtectedPluginRoutePath

src/gateway/security-path.ts

This function is a wrapper around the vulnerable `isPathProtectedByPrefixes` function, specifically for checking protected plugin routes. It was the function the HTTP server used to determine if authentication was needed. Because it relied on a flawed implementation, it would incorrectly report that a deeply encoded protected path was not protected, leading directly to the authentication bypass.

createGatewayHttpServer

src/gateway/server-http.ts

This function contains the main request handling logic for the gateway. It was vulnerable because it used the flawed `isProtectedPluginRoutePath` function to decide whether to enforce gateway authentication on plugin routes. This allowed requests with specially crafted, deeply encoded paths to bypass authentication checks and be processed by plugin handlers that should have been protected.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.