OpenClaw Gateway CVE-2026-100555

Exploitation requires that remote URL attachment forwarding is enabled in Synology Chat AND that the Gateway accepts a remotely-influenced hostname for attachment delivery - a non-default, feature-specific pathway. The attacker must be an authenticated, write-scoped caller (PR:L) and must win a DNS rebinding race between the Gateway's single validated DNS lookup and the NAS's later independent resolution of the original hostname (AC:H, AT:P). Success further depends on NAS network routing reachability to the private target and a useful response existing at that destination. Limiting factors: the documented workaround (disabling remote URL attachment forwarding) fully mitigates, and the narrow affected window (2026.7.1 through 2026.8.0) plus authentication requirement bound exposure.

The vendor CVSS 4.0 score of 7.1 (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N) is a HIGH rating, but multiple signals argue for treating this as a lower real-world priority. The vector itself concedes AC:H (high complexity - DNS rebinding requires precise resolver/timing control between the Gateway's validation and the NAS's later resolution) and AT:P (a specific attack precondition), and PR:L (an authenticated, write-scoped caller into the Gateway). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - no public exploit identified at time of analysis. The genuine impact is confidentiality-oriented (VC:H / SC:H): the NAS fetches a private or policy-denied resource and echoes its contents into a conversation. The vendor's SC:H subsequent-system scoring inflates the base score somewhat; the practical effect is information disclosure gated on NAS routing, resolver behavior, and whether a meaningful response exists at the private destination - the description explicitly hedges 'practical impact depends on' these factors. This mirrors sibling SSRF/DNS-rebinding advisories in the same product line where the vendor scoring runs generous. Net: a real, patchable SSRF worth fixing, but the config-dependency, TOCTOU timing, and required prior authentication make widespread opportunistic exploitation unlikely - this is a targeted, conditions-must-align issue rather than a drop-everything emergency.

An attacker who can influence an attachment file URL delivered through Synology Chat supplies a hostname they control, which passes the Gateway's single-shot DNS validation but is re-resolved by the Synology NAS to a private/internal address (DNS rebinding). The NAS then fetches an internal service (e.g., a cloud metadata endpoint or an internal admin page) and returns its contents into the addressed conversation, disclosing data. No public exploit code is identified; the rebinding timing window and NAS resolver behavior make reliable exploitation non-trivial.