PT-2026-26417 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-03 · Updated 2026-03-30 · CVE-2026-32036

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.26

Description The OpenClaw gateway plugin contains a path traversal issue that allows remote attackers to bypass route authentication checks. This is achieved by manipulating the /api/channels paths with encoded dot-segment traversal sequences. Attackers can construct alternate paths using encoded traversal patterns to access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls. The vulnerability occurs when plugin handlers decode and canonicalize the incoming path before routing to /api/channels handlers. The vulnerable component is the route authentication protection for the /api/channels endpoint. The vulnerability is triggered by using encoded dot-segment traversal sequences, such as ..%2f, in path variants.

Recommendations Update to version 2026.2.26 or later.

Fix

Path traversal

Weakness Enumeration

CWE-289

CWE-22

Related Identifiers

CVE-2026-32036

GHSA-MWXV-35WR-4VVJ

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/258d615c45527ffda37cecd08cd268f97461bde0 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mwxv-35wr-4vvj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32036 · Security Note
• https://osv.dev/vulnerability/GHSA-mwxv-35wr-4vvj · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/pulsepatchio/status/2038635654981226608 · Twitter Post
• https://twitter.com/CVEnew/status/2034891580826370348 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authentication-bypass-via-encoded-dot-segment-traversal-in-api-channels · Note