CVE-2026-32036
OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded traversal patterns to access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.3
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.43%
- CWE
- CWE-289
- Published
- 2026-03-19
- Last modified
- 2026-06-23
Affected products
- OpenClaw OpenClaw
- OpenClaw OpenClaw
Weakness type
Related vulnerabilities
- CVE-2026-15980 — MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
- CVE-2026-32639 — Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
- CVE-2026-15985 — Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
- CVE-2026-8457 — WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
- CVE-2026-10842 — IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability
- CVE-2026-9701 — Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
- CVE-2026-55075 — Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
- CVE-2026-56091 — Apache Shiro: Authentication bypass in Guice-Web integration