CVE-2026-32004: OpenClaw auth bypass exposes

CISO Take

CVE-2026-32004 is an authentication bypass in OpenClaw's /api/channels endpoint, exploitable by any unauthenticated network attacker who submits multi-encoded slash variants (e.g., %252f) that confuse the framework's path classifier while routing normally to the protected endpoint. Despite a medium CVSS score of 6.5, the vector assigns High integrity impact (I:H) with no privileges required — meaning a successful attacker can write to protected channel resources without credentials. EPSS places this in the 79th percentile for exploitation likelihood, above the vast majority of published CVEs, and AIID incident #1368 confirms that OpenClaw's plugin channel ecosystem has already been actively abused to deliver credential stealers, making unauthorized channel access a credible stepping stone to supply-chain compromise. Patch to OpenClaw 2026.3.2 immediately; as a short-term control, deploy a WAF rule or reverse proxy that normalizes percent-encoded characters before routing to /api/channels and block requests containing %25 sequences targeting the channels path.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium-severity authentication bypass with disproportionate integrity impact for AI agent deployments. The AC:H complexity reflects the multi-encoding sophistication required, which suppresses opportunistic mass exploitation, but PR:N with network access means any internet-connected OpenClaw instance is in scope. The package carries 396 historical CVEs, signaling a systemic security posture problem that elevates residual risk beyond this single issue. In environments where OpenClaw manages agentic plugin channels, successful exploitation grants unauthenticated write access to channel configuration — a particularly dangerous primitive in AI agent architectures where channels govern tool availability, skill loading, and inter-agent communication.

How does the attack unfold?

Initial Access

Attacker identifies an internet or intranet-exposed OpenClaw instance below version 2026.3.2 with /api/channels reachable, using passive reconnaissance or the VulnCheck advisory as a technical guide.

AML.T0049

Authentication Bypass

Attacker submits HTTP requests with multi-encoded slash variants (e.g., /%252fapi%252fchannels) causing the auth middleware to misclassify the path as unprotected while the router resolves it to the actual /api/channels handler.

AML.T0107

Channel Manipulation

With auth bypassed, attacker registers a malicious OpenClaw skill or modifies existing channel configurations, injecting a backdoored plugin pointing to attacker-controlled infrastructure.

AML.T0081

Impact — Credential Exfiltration

When a legitimate agent user invokes the poisoned channel, the malicious skill executes within the agent runtime, exfiltrating API keys, session tokens, and environment credentials to attacker C2.

AML.T0053

Initial Access

Attacker identifies an internet or intranet-exposed OpenClaw instance below version 2026.3.2 with /api/channels reachable, using passive reconnaissance or the VulnCheck advisory as a technical guide.

AML.T0049

Authentication Bypass

Attacker submits HTTP requests with multi-encoded slash variants (e.g., /%252fapi%252fchannels) causing the auth middleware to misclassify the path as unprotected while the router resolves it to the actual /api/channels handler.

AML.T0107

Channel Manipulation

With auth bypassed, attacker registers a malicious OpenClaw skill or modifies existing channel configurations, injecting a backdoored plugin pointing to attacker-controlled infrastructure.

AML.T0081

Impact — Credential Exfiltration

When a legitimate agent user invokes the poisoned channel, the malicious skill executes within the agent runtime, exfiltrating API keys, session tokens, and environment credentials to attacker C2.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I High

A None

What should I do?

6 steps

Patch: upgrade OpenClaw to 2026.3.2 (reference commits 93b0724, 2fd8264, d74bc25, 7a7eee9 in the official advisory).
If patching is blocked, apply WAF rules to decode and normalize URL-encoded characters (especially %25 → % chains) before they reach the routing layer, then re-apply auth checks on the normalized path.
Network-layer control: restrict /api/channels to authenticated internal networks only via firewall ACL or reverse proxy allowlist.
Detection: audit web access logs for requests to /api/channels containing %25 or %252f patterns — these are strong indicators of exploitation attempts.
Validate all installed OpenClaw skills/plugins against a known-good inventory; the AIID #1368 incident shows malicious skills are a realistic post-exploitation payload.
Monitor outbound connections from the OpenClaw process for unexpected destinations consistent with credential stealer C2.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Supply Chain Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15(1) - Accuracy, robustness and cybersecurity

ISO 42001

A.9.7 - Security-relevant testing and evaluation

NIST AI RMF

MANAGE-2.2 - Mechanisms to address AI risk

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32004?

CVE-2026-32004 is an authentication bypass in OpenClaw's /api/channels endpoint, exploitable by any unauthenticated network attacker who submits multi-encoded slash variants (e.g., %252f) that confuse the framework's path classifier while routing normally to the protected endpoint. Despite a medium CVSS score of 6.5, the vector assigns High integrity impact (I:H) with no privileges required — meaning a successful attacker can write to protected channel resources without credentials. EPSS places this in the 79th percentile for exploitation likelihood, above the vast majority of published CVEs, and AIID incident #1368 confirms that OpenClaw's plugin channel ecosystem has already been actively abused to deliver credential stealers, making unauthorized channel access a credible stepping stone to supply-chain compromise. Patch to OpenClaw 2026.3.2 immediately; as a short-term control, deploy a WAF rule or reverse proxy that normalizes percent-encoded characters before routing to /api/channels and block requests containing %25 sequences targeting the channels path.

Is CVE-2026-32004 actively exploited?

No confirmed active exploitation of CVE-2026-32004 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32004?

1. Patch: upgrade OpenClaw to 2026.3.2 (reference commits 93b0724, 2fd8264, d74bc25, 7a7eee9 in the official advisory). 2. If patching is blocked, apply WAF rules to decode and normalize URL-encoded characters (especially %25 → % chains) before they reach the routing layer, then re-apply auth checks on the normalized path. 3. Network-layer control: restrict /api/channels to authenticated internal networks only via firewall ACL or reverse proxy allowlist. 4. Detection: audit web access logs for requests to /api/channels containing %25 or %252f patterns — these are strong indicators of exploitation attempts. 5. Validate all installed OpenClaw skills/plugins against a known-good inventory; the AIID #1368 incident shows malicious skills are a realistic post-exploitation payload. 6. Monitor outbound connections from the OpenClaw process for unexpected destinations consistent with credential stealer C2.

What systems are affected by CVE-2026-32004?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin and skill ecosystems, AI agent API endpoints, multi-agent orchestration pipelines.

What is the CVSS score for CVE-2026-32004?

CVE-2026-32004 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin and skill ecosystemsAI agent API endpointsmulti-agent orchestration pipelines

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15(1)

ISO 42001: A.9.7

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitting deeply encoded slash variants such as multi-encoded %2f to access protected /api/channels endpoints.

Exploitation Scenario

An external attacker identifies a target organization running OpenClaw < 2026.3.2 with the agent API exposed on a corporate network segment. Using the VulnCheck advisory as a technical reference, the attacker crafts an HTTP request to /api/channels with the path encoded as /%252fapi%252fchannels — the auth middleware classifies this as a non-protected route due to the canonicalization depth mismatch, granting the request through unauthenticated. The underlying router then decodes the path to /api/channels and executes the handler. The attacker registers a malicious OpenClaw skill pointing to an attacker-controlled ClawHub endpoint, mirroring the AIID #1368 AMOS stealer delivery chain. The next time an agent user invokes a channel skill, the malicious skill executes within the agent's execution context, exfiltrating stored credentials and API keys.

Weaknesses (CWE)

CWE-288 Authentication Bypass Using an Alternate Path or Channel

CWE-288 — Authentication Bypass Using an Alternate Path or Channel: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

[Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE corpus.