CVE-2026-32036
Published: 19 March 2026
Description
OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded traversal patterns to…
more
access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls.
Mitigating Controls (NIST 800-53 r5)AI
Information Input Validation directly prevents path traversal attacks by sanitizing and validating manipulated /api/channels paths with encoded dot-segment sequences before processing.
Flaw Remediation requires updating the OpenClaw gateway plugin to version 2026.2.26 or later, which patches the normalization flaw allowing authentication bypass.
Access Enforcement ensures logical access policies are applied correctly to protected plugin channel routes, mitigating bypass via crafted alternate paths.
Security SummaryAI
CVE-2026-32036 is a path traversal vulnerability in the OpenClaw gateway plugin versions prior to 2026.2.26. It enables remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Handlers that normalize incoming paths allow attackers to craft alternate paths, accessing protected plugin channel routes and circumventing security controls. The issue maps to CWE-289 (Authentication Bypass by Alternate Name) and CWE-22 (Path Traversal), with a CVSS v3.1 base score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N). It was published on 2026-03-19.
Remote attackers can exploit this vulnerability over the network without privileges or user interaction, though it demands high attack complexity. By sending crafted requests with encoded traversal patterns, they bypass authentication on protected /api/channels routes, achieving low confidentiality impact but high integrity impact, such as unauthorized modifications to plugin channels, with no availability disruption.
Advisories recommend updating the OpenClaw gateway plugin to version 2026.2.26 or later to mitigate the issue. Patch details are in the GitHub commit at https://github.com/openclaw/openclaw/commit/258d615c45527ffda37cecd08cd268f97461bde0, with further guidance in the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-mwxv-35wr-4vvj and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-encoded-dot-segment-traversal-in-api-channels.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a path traversal in a public-facing gateway plugin API that enables remote attackers to bypass authentication and access protected routes, directly mapping to exploitation of public-facing applications.