CVE-2026-32036: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32036 is a path traversal and authentication bypass vulnerability in the OpenClaw gateway plugin (npm package) affecting all versions up to and including 2026.2.25. The flaw allows remote, unauthenticated attackers to bypass route authentication checks on protected /api/channels paths by supplying encoded dot-segment traversal sequences (e.g., ..%2f) in crafted HTTP requests. The vulnerability was reported by researcher @zpbrent and disclosed via a GitHub Security Advisory on February 26, 2026, with CVE assignment following on March 19, 2026. It carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Feedly).

The root cause is classified under CWE-289 (Authentication Bypass by Alternate Name) and CWE-22 (Path Traversal). The gateway plugin enforces authentication based on the literal path string of incoming requests to /api/channels; however, when plugin handlers decode or canonicalize the incoming URL (normalizing percent-encoded sequences such as ..%2f), the resulting normalized path matches a protected route that the authentication layer did not originally recognize as requiring protection. An attacker can craft an HTTP request with an encoded traversal variant of the protected path — for example, /api/channels/..%2f<target> — which bypasses the authentication check at the gateway layer but is subsequently routed to the protected handler after normalization. No authentication, special privileges, or user interaction are required to exploit this vulnerability over the network (GitHub Advisory, Feedly).

Successful exploitation allows remote, unauthenticated attackers to access protected plugin channel routes without valid credentials, resulting in a high integrity impact (unauthorized data modification) and low confidentiality impact (partial disclosure of sensitive information). The vulnerability does not affect availability. Because the bypass requires no user interaction and is network-accessible, it poses a significant risk to any internet-facing deployment of the OpenClaw gateway plugin running a vulnerable version (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.057%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify internet-facing services running the OpenClaw npm gateway plugin at version 2026.2.25 or earlier, using package metadata, exposed API endpoints, or service fingerprinting tools.
2. Identify protected endpoint: Determine a protected /api/channels/ route that normally requires authentication (e.g., /api/channels/admin).
3. Craft encoded traversal path: Construct an HTTP request using an encoded dot-segment traversal variant of the target path, such as /api/channels/..%2fadmin or similar encoded sequences (e.g., %2e%2e%2f) that the authentication layer does not recognize as the protected route.
4. Send unauthenticated request: Issue the crafted HTTP request to the target server without any authentication headers or tokens.
5. Achieve bypass: The gateway's authentication check evaluates the encoded path and does not match it to the protected route, allowing the request through. The plugin handler then normalizes/decodes the path, routing the request to the protected /api/channels/ handler.
6. Access protected resources: Interact with the protected channel route to read sensitive data or perform unauthorized modifications (GitHub Advisory, Feedly).

• Network: HTTP requests to /api/channels/ paths containing percent-encoded dot-segment sequences such as ..%2f, %2e%2e%2f, ..%2F, or similar URL-encoded traversal patterns in access logs.
• Logs: Web/gateway access logs showing requests to /api/channels/ variants with encoded characters that resolve to protected routes, particularly from unauthenticated sessions (no Authorization header or session token present).
• Logs: Unexpected successful (2xx) HTTP responses to /api/channels/ paths that should normally return 401 or 403 for unauthenticated requests.
• Network: Unusual or repeated probing of /api/channels/ endpoint variants from a single source IP, potentially indicating automated scanning or exploitation attempts (GitHub Advisory, Feedly).

The patched version is OpenClaw 2026.2.26 (npm package), which resolves the authentication bypass by properly handling encoded path variants before authentication checks are applied. Administrators should upgrade immediately using npm install openclaw@2026.2.26 or later. For systems that cannot be patched immediately, implement network-level access controls (e.g., firewall rules, reverse proxy restrictions) to limit access to /api/channels endpoints to trusted sources only. Additionally, review server-side input validation to ensure path normalization occurs before — not after — authentication enforcement (GitHub Advisory, GitHub Commit).