CVE-2026-35635CWE-706

OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat

Medium · published April 9, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account DM access control policies and replace route ownership across accounts.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2026-04-09T21:27Z
EPSS history
Timeline
  • 09 APR 21:27Z
    OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat
    cvelistv5