CVE-2026-32036: OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels

Published Mar 19, 2026
·
Updated

OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded traversal patterns to access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls.

Affected Software

2 affected components
OpenClaw OpenClaw gateway plugin<2026.2.26
OpenClaw Openclaw Node.js<2026.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade OpenClaw gateway plugin to a version that resolves this vulnerability.

    Fixed in 2026.2.26

Event History

Mar 19, 2026
CVE Published
via MITRE·10:07 PM
Data Sourced
via MITRE·10:07 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-32036?

CVE-2026-32036 has been rated as a high severity vulnerability due to its potential to allow unauthorized access.

2

How do I fix CVE-2026-32036?

To resolve CVE-2026-32036, update the OpenClaw gateway plugin to version 2026.2.26 or later.

3

What type of vulnerability is CVE-2026-32036?

CVE-2026-32036 is an authentication bypass vulnerability that occurs via encoded dot-segment traversal.

4

Which versions of the OpenClaw gateway plugin are affected by CVE-2026-32036?

CVE-2026-32036 affects OpenClaw gateway plugin versions prior to 2026.2.26.

5

What can attackers do with CVE-2026-32036?

Attackers exploiting CVE-2026-32036 can bypass route authentication checks, gaining unauthorized access to API channels.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203