Untriaged
Permalink
CVE-2026-32004
6.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): HIGH
- Availability impact (A): NONE
OpenClaw < 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Route
OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitting deeply encoded slash variants such as multi-encoded %2f to access protected /api/channels endpoints.
References
- VulnCheck Advisory: OpenClaw < 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Route third-party-advisory
- GitHub Security Advisory (GHSA-v865-p3gq-hw6m) third-party-advisory
- Patch Commit #1 patch
- Patch Commit #2 patch
- Patch Commit #3 patch
- Patch Commit #4 patch
Affected products
OpenClaw
- <2026.3.2
- ==2026.3.2
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>