CVE-2026-32036

OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels

State: Published
Severity: 8.3 High
Published: Mar 19, 2026
Updated: Jun 23, 2026
Reserved: Mar 10, 2026

Description

OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded traversal patterns to access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N	VulnCheck

Weaknesses

CWE-289 Authentication Bypass by Alternate Name

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.2.26Affected 2026.2.26Not affected

References

GitHub Security Advisory (GHSA-mwxv-35wr-4vvj)vendor-advisory
Patch Commitpatch
VulnCheck Advisory: OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channelsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.