What is the CVSS score of CVE-2026-32004?

CVE-2026-32004 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-32004?

CVE-2026-32004 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32004?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openclaw CVE-2026-32004

MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-19 disclosure@vulncheck.com

GHSA-v865-p3gq-hw6m

Authentication Bypass Openclaw

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on openclaw (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.2.

DescriptionCVE.org

OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitting deeply encoded slash variants such as multi-encoded %2f to access protected /api/channels endpoints.

AnalysisAI

OpenClaw prior to version 2026.3.2 allows unauthenticated attackers to bypass authentication controls on the /api/channels endpoint through path canonicalization mismatches, enabling access to protected API resources. The vulnerability exploits inconsistent handling of multi-encoded slash characters (%2f variants) between authentication checks and route processing. No patch is currently available, and exploitation requires only network access with no user interaction.

Technical ContextAI

The vulnerability stems from CWE-288 (Authentication Bypass by Alternate Route/Channel), specifically a canonicalization depth mismatch in path-based access control. OpenClaw's authentication middleware classifies routes to protect /api/channels endpoints by analyzing authentication policy paths, but the actual HTTP route dispatcher canonicalizes paths at a different depth or iteration count. When an attacker submits a request with multi-encoded forward slashes (e.g., %252f, %25252f), the auth-path classifier fails to decode sufficiently and permits the request, while the route handler decodes more deeply and correctly maps to the protected /api/channels endpoint. This is a classic implementation gap between two security-critical path normalization routines in the same application stack. The root cause involves inconsistent URL canonicalization between the authentication gate and the routing layer, allowing an attacker-controlled request to slip past security checks by exploiting the difference in decoding depth.

RemediationAI

Upgrade OpenClaw immediately to version 2026.3.2 or later, which implements consistent canonicalization depth between authentication path classification and route-path handling. The fix is available via the vendor's GitHub repository (referenced commit hashes: 2fd8264, 7a7eee9, 93b0724, d74bc25) and should be integrated into your deployment as soon as possible. Until patching is complete, implement compensating controls by enforcing a Web Application Firewall (WAF) rule to block requests containing multi-encoded slashes (e.g., %252f, %25252f) destined for /api/channels routes, and restrict network access to the OpenClaw API to trusted internal IP ranges only. Consult the vendor's security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-v865-p3gq-hw6m and VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-encoded-path-in-api-channels-route for detailed patch notes and deployment guidance.