Webhook Reply Delivery Vulnerability in OpenClaw by Synology

CVE-2026-35670

What is CVE-2026-35670?

OpenClaw versions before 2026.3.22 are susceptible to a webhook reply delivery vulnerability. This flaw enables attackers to rebind chat replies to unintended users by exploiting mutable username matching instead of stable numeric user identifiers. By maliciously changing a username, attackers can redirect webhook-triggered replies away from the intended recipients, effectively bypassing the binding trust established in the webhook events. This creates significant security risks and requires immediate attention to mitigate potential exploitation.

References