What is the CVSS score of CVE-2026-32036?

CVE-2026-32036 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-32036?

Organizations using versions should be aware of notable risk from CVE-2026-32036 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32036?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Openclaw CVE-2026-32036

MEDIUM

Authentication Bypass by Alternate Name (CWE-289)

2026-03-19 disclosure@vulncheck.com

GHSA-mwxv-35wr-4vvj

Path Traversal Openclaw

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.2.26.

DescriptionCVE.org

OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded traversal patterns to access protected plugin channel routes when handlers normalize the incoming path, circumventing security controls.

AnalysisAI

OpenClaw gateway plugin versions before 2026.2.26 allow remote attackers to bypass authentication by exploiting path traversal in the /api/channels endpoint through encoded dot-segment sequences. Attackers can manipulate these paths to access protected plugin routes that should be restricted, gaining unauthorized access to sensitive channel functionality. No patch is currently available for this medium-severity vulnerability.

Technical ContextAI

The vulnerability stems from a path normalization weakness in the OpenClaw gateway plugin's route handling mechanism. OpenClaw is an API gateway product that uses plugin-based architecture to manage API channels and routing. The root cause is classified under CWE-289 (Authentication Bypass by Alternate Name), though the description indicates CWE-22 (Path Traversal) is also relevant—the vulnerability exploits the gap between request parsing and path normalization logic. When a client sends a request with encoded dot-segment sequences (e.g., %2e%2e representing dot characters), the authentication middleware evaluates the path before it is fully normalized, allowing traversal to bypass access control checks. The gateway's handler then normalizes the path during request processing, successfully routing the request to a protected endpoint. This class of vulnerability typically occurs when path canonicalization is performed out-of-order relative to security checks, a common architectural weakness in multi-stage HTTP request processing pipelines.

RemediationAI

Immediately upgrade OpenClaw gateway plugin to version 2026.2.26 or later to obtain the path normalization fix. Organizations unable to patch immediately should implement compensating controls: enable detailed request logging and monitoring for suspicious /api/channels requests containing encoded characters (%2e, %2d, etc.); deploy a Web Application Firewall (WAF) rule to block requests with encoded dot-segments in the path before they reach the gateway; restrict network access to the OpenClaw gateway to trusted sources only; and conduct a security audit of any API calls made to protected channels during the vulnerability window to detect unauthorized access. For critical deployments, consider disabling the affected plugin or routing traffic through a reverse proxy that performs strict path canonicalization before the OpenClaw gateway receives the request. See the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-mwxv-35wr-4vvj and the VulnCheck advisory for detailed patch release notes.