PT-2026-26238 · Synology+1 · Synology Chat+2

Tdjackey · Published 2026-02-25 · Updated 2026-03-21 · CVE-2026-31998

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.22 through 2026.2.23

Description The openclaw software, specifically in versions 2026.2.22 and 2026.2.23, has an authorization bypass issue within the synology-chat channel plugin. When the dmPolicy is set to allowlist and allowedUserIds is empty, authorization checks are bypassed, allowing unauthorized agent dispatch and downstream tool actions. This requires Synology sender access. The root cause is a policy mismatch where an empty allowedUserIds is treated as allowing all access. The vulnerable component is the webhook authentication in allowlist mode, which depends on a helper function that incorrectly handles empty allowedUserIds. The affected API endpoint is not explicitly mentioned.

Recommendations Update to OpenClaw version 2026.2.24 or later.

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

BDU:2026-05005

CVE-2026-31998

GHSA-GW85-XP4Q-5GP9

GHSA-JQPF-VJ28-9V7R

Affected Products

Openclaw

Synology

Synology Chat

References · 16

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gw85-xp4q-5gp9 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5 · Patch
• https://github.com/openclaw/openclaw/commit/7655c0cb3a47d0647cbbf5284e177f90b4b82ddb · Patch
• https://osv.dev/vulnerability/GHSA-jqpf-vj28-9v7r · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05005 · Security Note
• https://osv.dev/vulnerability/GHSA-gw85-xp4q-5gp9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31998 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31998 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/cyberbivash/status/2034467516664201614 · Twitter Post
• https://twitter.com/CVEnew/status/2034520386918903835 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authorization-bypass-in-synology-chat-plugin-via-empty-alloweduserids · Note
• https://twitter.com/VulmonFeeds/status/2034483200991384054 · Twitter Post
• https://twitter.com/vuln_tracker/status/2034696935341224267 · Twitter Post
• https://twitter.com/RedPacketSec/status/2034508376747483522 · Twitter Post