CVE-2026-31998: OpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds
OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks and trigger unauthorized agent dispatch and downstream tool actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.2.24 - Configuration
Do not configure dmPolicy as 'allowlist' while leaving allowedUserIds empty. If using dmPolicy='allowlist', populate allowedUserIds with the intended authorized user IDs (ensure it is not an empty list).
OpenClaw synology-chat channel plugin dmPolicy / allowedUserIds = dmPolicy != 'allowlist' with an empty allowedUserIds; allowedUserIds must contain the authorized user IDs
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31998?
CVE-2026-31998 has a medium severity rating due to potential unauthorized access from an authorization bypass.
How do I fix CVE-2026-31998?
To fix CVE-2026-31998, update OpenClaw to version 2026.2.24 or later, which resolves the authorization bypass vulnerability.
What versions are affected by CVE-2026-31998?
CVE-2026-31998 affects OpenClaw versions 2026.2.22 and 2026.2.23.
What is the nature of the vulnerability in CVE-2026-31998?
The vulnerability in CVE-2026-31998 is an authorization bypass caused by the dmPolicy set to allowlist with empty allowedUserIds.
Can I continue using OpenClaw with CVE-2026-31998 vulnerability?
It is not recommended to continue using OpenClaw versions 2026.2.22 and 2026.2.23 as they expose you to security risks from CVE-2026-31998.