CVE-2026-35635
EUVD-2026-2112609.04.2026, 22:16
OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account DM access control policies and replace route ownership across accounts.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openclaw | openclaw | 𝑥 < 2026.3.22 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-706 - Use of Incorrectly-Resolved Name or ReferenceThe software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
References