Is there a patch available for CVE-2026-35635?

Yes, a patch is available for CVE-2026-35635. Update the affected software to the latest version immediately.

Openclaw CVE-2026-35635

Q: What is the CVSS score of CVE-2026-35635?

CVE-2026-35635 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21126 MEDIUM

Use of Incorrectly-Resolved Name or Reference (CWE-706)

2026-04-09 VulnCheck

GHSA-g8mc-c5f2-mqg7

Authentication Bypass Synology Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 21:45 euvd

EUVD-2026-21126

Analysis Generated

Apr 09, 2026 - 21:45 vuln.today

Patch released

Apr 09, 2026 - 21:45 nvd

Patch available

CVE Published

Apr 09, 2026 - 21:27 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.22.

DescriptionCVE.org

OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account DM access control policies and replace route ownership across accounts.

AnalysisAI

OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in its Synology Chat extension that allows unauthenticated remote attackers to bypass per-account direct message access controls by collapsing multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to replace route ownership across accounts, potentially gaining unauthorized access to account-specific resources. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from improper validation of webhook path routing in OpenClaw's Synology Chat extension, classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference). The root cause involves insufficient separation of webhook path namespaces across multi-account configurations, allowing an attacker to manipulate routing logic by providing crafted webhook paths that inherit or duplicate existing paths. This results in route ownership being reassigned across distinct accounts, effectively bypassing access control policies that depend on per-account webhook isolation. The vulnerability affects OpenClaw versions prior to 2026.3.22 as indicated by the CPE specification cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, which covers all versions before the patched release.

RemediationAI

Vendor-released patch: Upgrade OpenClaw to version 2026.3.22 or later. The fix is available in the upstream repository with commits referenced at https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 and https://github.com/openclaw/openclaw/commit/980940aa58f862da4e19372597bbc2a9f268d70b. For additional context and technical details about the vulnerability, consult the security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-rqp8-q22p-5j9q and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-webhook-path-route-replacement-vulnerability-in-synology-chat. Until patching is possible, organizations should review and audit their webhook path configurations to identify and isolate any duplicate or inherited paths across multi-account setups.