CVE-2026-32036: OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels
OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded traversal patterns to access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw gateway pluginto a version that resolves this vulnerability.Fixed in 2026.2.26
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32036?
CVE-2026-32036 has been rated as a high severity vulnerability due to its potential to allow unauthorized access.
How do I fix CVE-2026-32036?
To resolve CVE-2026-32036, update the OpenClaw gateway plugin to version 2026.2.26 or later.
What type of vulnerability is CVE-2026-32036?
CVE-2026-32036 is an authentication bypass vulnerability that occurs via encoded dot-segment traversal.
Which versions of the OpenClaw gateway plugin are affected by CVE-2026-32036?
CVE-2026-32036 affects OpenClaw gateway plugin versions prior to 2026.2.26.
What can attackers do with CVE-2026-32036?
Attackers exploiting CVE-2026-32036 can bypass route authentication checks, gaining unauthorized access to API channels.