CVE-2026-35670

MEDIUM EPSS 14.4%
Published Apr 10, 20262mo ago · Modified Jun 17, 20262w ago
6.0 CVSS 4.0
Medium
Find Similar
Published Apr 10, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutable username matching instead of stable numeric user identifiers. Attackers can manipulate username changes to redirect webhook-triggered replies to different users, bypassing the intended recipient binding recorded in webhook events.

CVSS Details

Base Score
6.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
14.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-807

Affected Products 1

VendorProductVersionRange
openclawopenclaw* <2026.3.22

References 4

  • github.com https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
    Patch
  • github.com https://github.com/openclaw/openclaw/commit/7ade3553b74ee3f461c4acd216653d5ba411f455
    Patch
  • github.com https://github.com/openclaw/openclaw/security/advisories/GHSA-wv46-v6xc-2qhf
    Vendor Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/openclaw-webhook-reply-rebinding-via-username-resolution-in-synology-chat
    Third Party Advisory

Remediation

  • github.com https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
    Patch
  • github.com https://github.com/openclaw/openclaw/commit/7ade3553b74ee3f461c4acd216653d5ba411f455
    Patch