CVE-2026-32004: Authentication Bypass Using an Alternate Path or Channel

OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin route authentication checks by submitti...

PT-2026-25488

Summary Updated March 2, 2026 Encoded alternate-path requests could bypass plugin route auth checks for /api/channels/ due to canonicalization depth mismatch in vulnerable builds. Affected Packages / Versions - Package: openclaw npm - Latest published vulnerable version: 2026.3.1 - Affected range...