CVE-2026-35670: OpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chat
OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutable username matching instead of stable numeric user identifiers. Attackers can manipulate username changes to redirect webhook-triggered replies to different users, bypassing the intended recipient binding recorded in webhook events.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35670?
CVE-2026-35670 is classified with a high severity due to its potential exploitation leading to unauthorized access to chat replies.
How do I fix CVE-2026-35670?
To fix CVE-2026-35670, upgrade Synology OpenClaw to version 2026.3.22 or later.
What types of software are affected by CVE-2026-35670?
CVE-2026-35670 affects Synology OpenClaw versions prior to 2026.3.22.
What is the impact of CVE-2026-35670?
The impact of CVE-2026-35670 includes the ability for attackers to rebind chat replies, potentially leading to information leakage.
Is there a workaround for CVE-2026-35670?
There is no official workaround for CVE-2026-35670; the recommended solution is to upgrade to the latest version.