CVE-2026-32036: OpenClaw auth bypass

CISO Take

OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability (CWE-289) that lets unauthenticated remote attackers bypass route-level authentication by encoding dot-segment sequences in /api/channels API paths — the handler normalizes the URL after the auth check, creating a window where protected plugin channels are reachable without credentials. Despite the medium CVSS score (6.5), the integrity impact is rated HIGH and the EPSS places this in the top 66th percentile for exploitation likelihood; the package also carries 396 prior CVEs, signaling a historically weak security posture. The AIID has already documented credential theft via malicious OpenClaw skills (#1368), meaning an auth bypass directly lowers the barrier to that same attack class. Patch to 2026.2.26 or later immediately; if patching is blocked, place the gateway behind an API gateway or WAF that normalizes and re-validates URL paths before forwarding, and audit /api/channels access logs for encoded traversal patterns (%2e, %252e, %2f variants).

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium-severity by CVSS but elevated in AI agent contexts. The HIGH integrity metric combined with no privileges required and no user interaction means a network-adjacent attacker can silently tamper with or read protected channel routes without authentication. Attack complexity is HIGH (specific encoding conditions must be met), which suppresses EPSS to 0.43% — but the OpenClaw ecosystem's prior credential-theft incidents (#1368) show motivated adversaries are already weaponizing this attack surface. With only 4 downstream dependents, blast radius is limited today but could expand as the ai_agent category grows.

How does the attack unfold?

Reconnaissance

Attacker identifies a public-facing OpenClaw gateway instance running a version prior to 2026.2.26 via GHSA disclosure, HTTP banners, or package metadata in public repositories.

AML.T0006

Payload Crafting

Attacker constructs requests to /api/channels using percent-encoded dot-segment sequences (e.g., %2e%2e or double-encoded variants) that pass the pre-normalization auth check but resolve to protected routes after the handler normalizes the path.

AML.T0107

Authentication Bypass

The gateway handler normalizes the incoming path after the auth check, allowing the crafted request to reach protected plugin channel routes as if it were an authenticated call.

AML.T0049

Impact

Attacker reads agent configuration, harvests credentials or API tokens proxied by the channel, or injects forged responses to redirect downstream agent tool invocations to attacker-controlled infrastructure.

AML.T0053

Reconnaissance

Attacker identifies a public-facing OpenClaw gateway instance running a version prior to 2026.2.26 via GHSA disclosure, HTTP banners, or package metadata in public repositories.

AML.T0006

Payload Crafting

Attacker constructs requests to /api/channels using percent-encoded dot-segment sequences (e.g., %2e%2e or double-encoded variants) that pass the pre-normalization auth check but resolve to protected routes after the handler normalizes the path.

AML.T0107

Authentication Bypass

The gateway handler normalizes the incoming path after the auth check, allowing the crafted request to reach protected plugin channel routes as if it were an authenticated call.

AML.T0049

Impact

Attacker reads agent configuration, harvests credentials or API tokens proxied by the channel, or injects forged responses to redirect downstream agent tool invocations to attacker-controlled infrastructure.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I High

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.2.26 or later (patch commit 258d615c45527ffda37cecd08cd268f97461bde0).
Immediate workaround: Deploy a reverse proxy or WAF rule that normalizes all incoming URL paths (decode percent-encoding, resolve dot segments) before forwarding to the gateway, effectively collapsing traversal variants to canonical paths.
Network segmentation: Ensure /api/channels is not exposed to untrusted networks; enforce IP allowlisting if the gateway serves internal agents only.
Detection: Search access logs for encoded traversal patterns in channel paths: %2e%2e, %252e, %2f, ..%2f, %2e%2f. Alert on 2xx responses to requests containing these patterns.
Audit: Review which plugin channels were accessible from external IPs in the 90 days prior to patching.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Plugin AML.T0002.002 - AI Agent Configuration AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI risk management

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain oversight of deployed AI

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32036?

OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability (CWE-289) that lets unauthenticated remote attackers bypass route-level authentication by encoding dot-segment sequences in /api/channels API paths — the handler normalizes the URL after the auth check, creating a window where protected plugin channels are reachable without credentials. Despite the medium CVSS score (6.5), the integrity impact is rated HIGH and the EPSS places this in the top 66th percentile for exploitation likelihood; the package also carries 396 prior CVEs, signaling a historically weak security posture. The AIID has already documented credential theft via malicious OpenClaw skills (#1368), meaning an auth bypass directly lowers the barrier to that same attack class. Patch to 2026.2.26 or later immediately; if patching is blocked, place the gateway behind an API gateway or WAF that normalizes and re-validates URL paths before forwarding, and audit /api/channels access logs for encoded traversal patterns (%2e, %252e, %2f variants).

Is CVE-2026-32036 actively exploited?

No confirmed active exploitation of CVE-2026-32036 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32036?

1. Patch: Upgrade OpenClaw to version 2026.2.26 or later (patch commit 258d615c45527ffda37cecd08cd268f97461bde0). 2. Immediate workaround: Deploy a reverse proxy or WAF rule that normalizes all incoming URL paths (decode percent-encoding, resolve dot segments) before forwarding to the gateway, effectively collapsing traversal variants to canonical paths. 3. Network segmentation: Ensure /api/channels is not exposed to untrusted networks; enforce IP allowlisting if the gateway serves internal agents only. 4. Detection: Search access logs for encoded traversal patterns in channel paths: %2e%2e, %252e, %2f, ..%2f, %2e%2f. Alert on 2xx responses to requests containing these patterns. 5. Audit: Review which plugin channels were accessible from external IPs in the 90 days prior to patching.

What systems are affected by CVE-2026-32036?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, plugin/tool ecosystems, API gateway layers for agent orchestration, multi-agent pipelines with brokered authentication.

What is the CVSS score for CVE-2026-32036?

CVE-2026-32036 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksplugin/tool ecosystemsAPI gateway layers for agent orchestrationmulti-agent pipelines with brokered authentication

MITRE ATLAS Techniques

AML.T0002.002 AI Agent Configuration

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded traversal patterns to access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls.

Exploitation Scenario

An attacker targeting an organization's AI agent infrastructure identifies a public-facing OpenClaw gateway running a vulnerable version via banner or GHSA disclosure. They enumerate protected plugin channel routes from published documentation or the vendor advisory, then craft requests to /api/channels using percent-encoded dot-segment traversal (e.g., /api/channels/%2e%2e/admin/config) that bypass the route-level auth check when the handler normalizes the path post-check. With access to protected channels, the attacker reads agent configuration including API keys or OAuth tokens used by downstream tools, injects forged channel responses to redirect agent tool calls to attacker-controlled endpoints, or plants persistent instructions in agent memory — replicating the credential-exfiltration pattern documented in AIID #1368 without needing to publish a malicious skill.

Weaknesses (CWE)

CWE-289 Authentication Bypass by Alternate Name

CWE-289 — Authentication Bypass by Alternate Name: The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

[Architecture and Design] Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis

Source: MITRE CWE corpus.