PT-2026-31981 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-35670

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description OpenClaw contains a webhook reply delivery issue that allows attackers to redirect chat replies to unintended users. This is possible because the system uses mutable username matching instead of stable numeric user identifiers. By manipulating username changes, attackers can redirect webhook-triggered replies, bypassing the intended recipient binding recorded in webhook events.

Recommendations Update to version 2026.3.22 or later.

Fix

IDOR

Weakness Enumeration

CWE-807

CWE-706

CWE-639

Related Identifiers

CVE-2026-35670

GHSA-WV46-V6XC-2QHF

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wv46-v6xc-2qhf · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/7ade3553b74ee3f461c4acd216653d5ba411f455 · Patch
• https://osv.dev/vulnerability/GHSA-wv46-v6xc-2qhf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35670 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2042710240425058756 · Twitter Post
• https://vulncheck.com/advisories/openclaw-webhook-reply-rebinding-via-username-resolution-in-synology-chat · Note