Which versions of Synology are affected by EUVD-2026-13035?

OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability that could allow attackers with Synology sender access to execute unauthorized actions through the chat channel…. A patch is available.

How to fix or mitigate EUVD-2026-13035?

Within 24 hours: Identify all systems running OpenClaw 2026.2.22 or 2026.2.23 and assess Synology Chat integration usage. Within 7 days: Apply the available vendor patch to all affected instances; if patching cannot be completed, disable the synology-chat channel plugin. Within 30 days: Conduct access reviews of Synology sender accounts and verify agent dispatch logs for suspicious activity during the vulnerability window.

Synology EUVD-2026-13035

Q: What is the CVSS score of EUVD-2026-13035?

EUVD-2026-13035 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-31998 HIGH

Incorrect Authorization (CWE-863)

2026-03-19 VulnCheck

GHSA-gw85-xp4q-5gp9

Synology Authentication Bypass

8.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 01:30 euvd

EUVD-2026-13035

Analysis Generated

Mar 19, 2026 - 01:30 vuln.today

Patch released

Mar 19, 2026 - 01:30 nvd

Patch available

CVE Published

Mar 19, 2026 - 01:00 nvd

HIGH 8.3

DescriptionCVE.org

OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks and trigger unauthorized agent dispatch and downstream tool actions.

AnalysisAI

Synology OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass in the synology-chat channel plugin where misconfigured allowlist policies with empty user IDs fail open, allowing authenticated Synology senders to dispatch unauthorized agents and execute downstream tool actions. The vulnerability requires network access and low-complexity exploitation, with a patch currently available.

Technical ContextAI

This vulnerability affects OpenClaw (cpe:2.3:a:openclaw:openclaw), an agent framework integrating with Synology Chat. The root cause is CWE-863 (Incorrect Authorization), specifically a logic error in the synology-chat channel plugin's authorization implementation. When administrators configure the dmPolicy to use an allowlist but leave the allowedUserIds array empty, the system fails open rather than implementing secure-by-default behavior. This allows any Synology sender to pass authorization checks, enabling them to dispatch agents and invoke tool actions that should be restricted. The vulnerability represents a classic fail-open security pattern where an empty or undefined security control incorrectly permits access rather than denying it.

RemediationAI

Upgrade OpenClaw to a patched version by applying the security fixes available in commits 0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5 and 7655c0cb3a47d0647cbbf5284e177f90b4b82ddb from the vendor repository at https://github.com/openclaw/openclaw/. Review all synology-chat plugin configurations to ensure dmPolicy allowlist settings include properly populated allowedUserIds arrays, or switch to deny-by-default authorization models. As an interim mitigation until patching, organizations can disable the synology-chat channel plugin entirely if not required for business operations, or implement network-level access controls to restrict Synology Chat integration endpoints to trusted IP ranges only. Consult the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-gw85-xp4q-5gp9 for vendor-specific guidance.