OpenClaw server-http uses a gateway authentication guard that is intended to protect plugin channel endpoints. A mismatch in path canonicalization between the guard and the plugin handler routing allows an attacker to encode the request path differently and bypass the guard, thus gaining access to the protected APIs without authenticating. This flaw results in an authentication bypass that can expose private data or allow unintended API calls.

All OpenClaw installations running a version earlier than 2026.2.26 are affected. The vulnerability affects the OpenClaw product, specifically the gateway handling of API channel endpoints, as documented by the vulnerability advisories linked above.

The CVSS v3 score is 6.3, indicating a medium severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The attack vector is remote over the network; an attacker only needs to send a specially crafted request with an encoded path to trigger the bypass. No authentication required, no privilege escalation beyond the scope of the API. The vulnerability could be exploited by malicious actors to access proprietary plugin data or execute unintended operations. The risk is moderate but mitigated by applying the latest patch.