PT-2026-31770 · Openclaw+1 · Openclaw+1

Tdjackey · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-35635

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description OpenClaw before version 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension. This allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account direct message access control policies and replace route ownership across accounts.

Recommendations Update OpenClaw to version 2026.3.22 or later.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

CWE-706

Related Identifiers

CVE-2026-35635

GHSA-G8MC-C5F2-MQG7

GHSA-RQP8-Q22P-5J9Q

Affected Products

Openclaw

Synology Chat

References · 11

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rqp8-q22p-5j9q · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/980940aa58f862da4e19372597bbc2a9f268d70b · Patch
• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://osv.dev/vulnerability/GHSA-g8mc-c5f2-mqg7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rqp8-q22p-5j9q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35635 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-webhook-path-route-replacement-vulnerability-in-synology-chat · Note
• https://twitter.com/CVEnew/status/2042364321846481043 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042366213523730818 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042464491300860150 · Twitter Post