OpenClaw gateway plugin versions older than 2026.2.26 contain a path traversal flaw that allows an attacker to bypass route authentication checks by inserting encoded dot‑segment (../) patterns into the /api/channels endpoint. The flaw is a classic example of CWE‑22 (Path Traversal) combined with a broken authentication control (CWE‑289). By crafting a malicious HTTP request that normalizes the path, an attacker can reach protected plugin channel routes that should require proper authorization, effectively gaining unauthorized access to configuration or control features exposed by the plugin.

The vulnerability impacts all OpenClaw gateway plugin deployments running versions prior to 2026.2.26. Vendors and products affected are OpenClaw’s OpenClaw gateway plugin; no specific sub‑components or modules are listed beyond the /api/channels interface.

The CVSS score of 8.3 classifies this as a high‑severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation data, although it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the attacker only needs the ability to send HTTP requests to the /api/channels endpoint. Successful exploitation does not require privileged access on the host but results in a privilege escalation by bypassing authentication.