CVE-2026-32004: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32004 is an authentication bypass vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.3.2. The flaw exists in the /api/channels route classification due to a canonicalization depth mismatch between auth-path classification and route-path canonicalization, allowing unauthenticated attackers to access protected endpoints. It was published on March 19, 2026, with patches released on March 23, 2026. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 8.3 (High) (Feedly, GitHub Advisory).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). In affected versions, the gateway's auth-path classification and route-path canonicalization diverge when processing deeply encoded slash variants — for example, multi-encoded %2f sequences such as %2525252f (4x encoded). The auth layer fails to recognize these paths as matching the protected /api/channels/* prefix, while the plugin route handler successfully resolves them to the canonical /api/channels/... path after iterative URL decoding. The fix hardens this by canonicalizing route paths to a bounded fixpoint (up to 32 decode passes), failing closed on malformed or unresolved canonicalization depth, requiring explicit auth contracts for plugin route registration, and enforcing route ownership/conflict guards (GitHub Advisory, Patch Commit 93b0724).

Successful exploitation allows unauthenticated remote attackers to access and modify sensitive channel data on protected /api/channels/* endpoints without credentials. The vulnerability has a high integrity impact (unauthorized data modification) and low confidentiality impact (partial data exposure), with no availability impact. Deployments that expose plugin HTTP routes and rely on gateway authentication for /api/channels/* protection are specifically at risk (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.052% (0.000520), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify internet-facing OpenClaw instances running npm package versions <= 2026.3.1 that expose plugin HTTP routes, particularly those with /api/channels/* endpoints accessible from the network.
2. Craft encoded path: Construct a deeply multi-encoded URL path that resolves to /api/channels/<target> after iterative URL decoding but is not recognized as protected by the auth layer. For example, encode the slashes four times: /api%2525252fchannels%2525252f<channel-id> (where %2525252f is a 4x-encoded /).
3. Send unauthenticated request: Submit an HTTP request (e.g., GET or POST) to the OpenClaw gateway using the crafted encoded path, without providing any authentication credentials or bearer token.
4. Bypass auth check: The gateway's auth-path classifier fails to match the encoded path against the protected /api/channels/* prefix and skips authentication enforcement, while the plugin route handler decodes the path iteratively and routes the request to the protected channel endpoint.
5. Access or modify channel data: The request is processed by the plugin handler as if authenticated, allowing the attacker to read or modify sensitive channel data (GitHub Advisory, Patch Commit 93b0724).

• Network: Unexpected HTTP requests to /api/channels/* endpoints containing multi-encoded slash sequences (e.g., %2525252f, %252f, %2f) in the URL path without a valid Authorization header; unauthenticated requests resolving to channel API routes.
• Logs: Gateway access logs showing requests to paths like /api%2525252fchannels%2525252f... that return HTTP 200 responses without authentication; absence of auth enforcement log entries for requests that successfully reach plugin channel handlers.
• Application Behavior: Unexpected modifications to channel data or configurations without corresponding authenticated user activity; plugin route handlers receiving requests from unknown or external IP addresses.

Upgrade OpenClaw (npm) to version 2026.3.2 or later, which includes four patch commits hardening path canonicalization and plugin route auth contracts (GitHub Advisory). As a temporary workaround prior to patching, deploy Web Application Firewall (WAF) rules to detect and block HTTP requests containing multi-encoded characters (e.g., %25, %2525) targeting /api/channels endpoints. Additionally, monitor access logs for suspicious encoded-path requests to the /api/channels endpoint and restrict network access to the OpenClaw gateway to trusted sources where possible (Feedly).

The vulnerability was reported by researcher tdjackey, who is credited in the OpenClaw changelog for both this issue and a related SSRF guard fix. The GitHub Security Advisory was published by maintainer steipete and rated as "Moderate" severity. No significant broader media coverage or notable community discussion beyond the official advisory and patch commits has been identified (GitHub Advisory).