In breve
- CVE-2026-32004 è una vulnerabilità ALTO (CVSS 8.2) che riguarda openclaw (openclaw), openclaw.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.31%, superiore al 23.8% delle vulnerabilità.
- Correzione: aggiornare a 2026.3.2 o successiva.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.2
| 2026.3.2
|
| openclaw npm | < 2026.3.2
| 2026.3.2
|
Description
Summary (Updated March 2, 2026)
Encoded alternate-path requests could bypass plugin route auth checks for /api/channels/* due to canonicalization depth mismatch in vulnerable builds.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published vulnerable version:
2026.3.1
- Affected range:
<= 2026.3.1
- Patched release:
2026.3.2 (patched_versions: >= 2026.3.2)
Technical Details
In affected versions, plugin auth-path classification and route-path canonicalization could diverge for deeply encoded slash variants (for example multi-encoded %2f). That mismatch allowed alternate encoded paths to evade protected-prefix auth checks while still resolving to /api/channels/... in plugin route handling.
The fix set hardens this class of issue by:
- canonicalizing route paths to a bounded fixpoint,
- failing closed on malformed or unresolved canonicalization depth,
- requiring explicit plugin-route auth contracts (no implicit auth default),
- enforcing route ownership/conflict guards for duplicate route registrations, and
- using shared webhook route lifecycle registration to avoid stale/conflicting route surfaces.
Affected Deployments
Deployments exposing plugin HTTP routes and relying on gateway auth for /api/channels/* protection.
Fix Commit(s)
93b07240257919f770d1e263e1f22753937b80ea2fd8264ab03bd178e62a5f0c50d1c8556c17f12dd74bc257d8432f17e50b23ae713d7e0623a1fe0f7a7eee920a176a0043398c6b37bf4cc6eb983eeb
NVD description
OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitting deeply encoded slash variants such as multi-encoded %2f to access protected /api/channels endpoints.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free