GHSA-8j2w-6fmm-m587
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
Gateway auth for plugin channel endpoints can be bypassed when path canonicalization differs between the gateway guard and plugin handler routing.
### Details
On affected versions, `server-http` only applies gateway auth when raw `requestPath` matches exactly:
- `/api/channels`
- `/api/channels/*`
If a plugin handler canonicalizes path input (for example `decodeURIComponent(pathname).toLowerCase()`), requests like:
- `/API/channels/nostr/default/profile`
- `/api/channels%2Fnostr%2Fdefault%2Fprofile`
can be interpreted as `/api/channels/*` by the plugin, while the gateway auth guard is skipped.
### Impact
Authentication boundary bypass for plugin channel HTTP routes under canonicalization mismatch conditions. Unauthorized callers may access plugin channel APIs that are expected to require gateway auth.
CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N` (Base 5.3, Moderate)
References
External links from the advisory. They lead to third-party sites.