CVE-2026-35670: OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

March 26, 2026 (updated April 10, 2026)

Synology Chat reply delivery could rebind to a mutable username match instead of the stable numeric user_id recorded by the webhook event.

References

github.com/advisories/GHSA-wv46-v6xc-2qhf
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/7ade3553b74ee3f461c4acd216653d5ba411f455
github.com/openclaw/openclaw/security/advisories/GHSA-wv46-v6xc-2qhf
nvd.nist.gov/vuln/detail/CVE-2026-35670

Code Behaviors & Features

Detect and mitigate CVE-2026-35670 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →