OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

보통 6.5CVE-2026-35646 · GHSA-mf5g-6r6f-ghhm · Published 09/04/2026 · updated 17/06/2026

요약

CVE-2026-35646은(는) openclaw (openclaw), openclaw에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.24%, 전체 취약점의 15.7%보다 높음.
조치: 2026.3.25, 2026.3.28 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
openclaw openclaw	`< 2026.3.25`	`2026.3.25`
openclaw npm	`< 2026.3.28`	`2026.3.28`

Description

Summary

Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Weak Webhook Token

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

Synology Chat webhook auth previously rejected invalid tokens without throttling repeated guesses, allowing brute-force attempts against weak webhook secrets. Commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c.

Fix Commit(s)

0b4d07337467f4d40a0cc1ced83d45ceaec0863c

NVD description

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to guess weak tokens through rapid successive requests.

References

openclaw/openclaw security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-35646 · ADVISORY
openclaw/openclaw commit 0b4d073 · WEB
openclaw/openclaw · PACKAGE
vulncheck.com/advisories/openclaw-pre-authentication-rate-limit-bypass-in-webhook-token-validation · WEB

openclaw의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openclaw

< 2026.3.25

2026.3.25

openclaw

npm

< 2026.3.28

2026.3.28

Description

Summary

Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Weak Webhook Token

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c.

Fix Commit(s)

0b4d07337467f4d40a0cc1ced83d45ceaec0863c

NVD description

openclaw의 다른 취약점

모두 보기 →