Skip to main content

Synology CVE-2026-35635

| EUVDEUVD-2026-21126 MEDIUM
Use of Incorrectly-Resolved Name or Reference (CWE-706)
2026-04-09 VulnCheck GHSA-g8mc-c5f2-mqg7
Authentication Bypass Synology
6.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
EUVD ID Assigned
Apr 09, 2026 - 21:45 euvd
EUVD-2026-21126
Analysis Generated
Apr 09, 2026 - 21:45 vuln.today
Patch released
Apr 09, 2026 - 21:45 nvd
Patch available
CVE Published
Apr 09, 2026 - 21:27 nvd
MEDIUM 6.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.22.

DescriptionCVE.org

OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account DM access control policies and replace route ownership across accounts.

AnalysisAI

OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in its Synology Chat extension that allows unauthenticated remote attackers to bypass per-account direct message access controls by collapsing multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to replace route ownership across accounts, potentially gaining unauthorized access to account-specific resources. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from improper validation of webhook path routing in OpenClaw's Synology Chat extension, classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference). The root cause involves insufficient separation of webhook path namespaces across multi-account configurations, allowing an attacker to manipulate routing logic by providing crafted webhook paths that inherit or duplicate existing paths. This results in route ownership being reassigned across distinct accounts, effectively bypassing access control policies that depend on per-account webhook isolation. The vulnerability affects OpenClaw versions prior to 2026.3.22 as indicated by the CPE specification cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, which covers all versions before the patched release.

RemediationAI

Vendor-released patch: Upgrade OpenClaw to version 2026.3.22 or later. The fix is available in the upstream repository with commits referenced at https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 and https://github.com/openclaw/openclaw/commit/980940aa58f862da4e19372597bbc2a9f268d70b. For additional context and technical details about the vulnerability, consult the security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-rqp8-q22p-5j9q and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-webhook-path-route-replacement-vulnerability-in-synology-chat. Until patching is possible, organizations should review and audit their webhook path configurations to identify and isolate any duplicate or inherited paths across multi-account setups.

More in Synology

View all
CVE-2013-6955 CRITICAL POC
10.0 Jan 09

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before

CVE-2017-15889 HIGH POC
8.8 Dec 04

Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authe
CVE-2017-9554 MEDIUM POC
5.3 Jul 24

An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allo
CVE-2015-6912 CRITICAL POC
10.0 Sep 11

Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharact
CVE-2013-6987 HIGH POC
7.5 Dec 31

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before

CVE-2017-11155 HIGH POC
7.5 Aug 08

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remot
CVE-2017-11153 CRITICAL POC
9.8 Aug 08

Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allo
CVE-2017-11151 CRITICAL POC
9.8 Aug 08

A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers
CVE-2016-10329 CRITICAL POC
9.8 May 12

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to exec
CVE-2017-11152 HIGH POC
7.5 Aug 08

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 all
CVE-2020-27655 CRITICAL POC
10.0 Oct 29

Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to acce
CVE-2024-10443 CRITICAL POC
9.8 Nov 15

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager

Same weakness CWE-706 – Use of Incorrectly-Resolved Name or Reference

View all
CVE-2021-40539 CRITICAL POC
9.8
CVE-2020-15505 CRITICAL POC
9.8
CVE-2019-8908 CRITICAL POC
9.8
CVE-2019-7731 CRITICAL POC
9.8
CVE-2021-37144 CRITICAL POC
9.1
CVE-2023-28643 HIGH POC
8.8
CVE-2024-27295 HIGH POC
8.2
CVE-2026-25890 HIGH POC
8.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-35635 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy