CVE-2026-35635Disclosure(openclaw / openclaw)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account DM access control policies and replace route ownership across accounts.

openclaw CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Weakness type (CWE)

CWE-706CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-04-09); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-09	2	Disclosure2
2026-04-10	1	Disclosure1

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds183d
Disclosure
CVE-2026-35635 Webhook Path Route Replacement Vulnerability in OpenClaw Synology Chat Extension https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35635
Post summary
The entry announces CVE‑2026‑35635, describing it as a Webhook Path Route Replacement Vulnerability in OpenClaw Synology Chat Extension, but offers no PoC, exploitation evidence, patch info, or false‑positive claim.
0000062
4.0K followersView on X
Infoflowcloud@infoflowcloud183d
Disclosure
🚨*CVE* CVE-2026-35635 OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account confi… https://www.cve.org/CVERecord?id=CVE-2026-35635 ----- Traducción: CVE-2026-35635 Ope… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑35635, describing a webhook path route replacement flaw in OpenClaw’s Synology Chat extension that could allow attackers to collapse multi‑account configurations, but it offers no further details such as PoC, exploitation code, patches, or evidence of real‑world attacks.
0000043
67 followersView on X
CVE@CVEnew183d
Disclosure
CVE-2026-35635 OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account confi… https://www.cve.org/CVERecord?id=CVE-2026-35635
Post summary
The tweet announces a newly disclosed vulnerability (CVE‑2026‑35635) in OpenClaw’s Synology Chat extension that allows attackers to exploit a webhook path route replacement flaw impacting multi‑account configurations, with no PoC, exploit, or patch mentioned.
00000224
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-35635

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The entry announces CVE‑2026‑35635, describing it as a Webhook Path Route Replacement Vulnerability in OpenClaw Synology Chat Extension, but offers no PoC, exploitation evidence, patch info, or false‑positive claim.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE‑2026‑35635, describing a webhook path route replacement flaw in OpenClaw’s Synology Chat extension that could allow attackers to collapse multi‑account configurations, but it offers no further details such as PoC, exploitation code, patches, or evidence of real‑world attacks.

CVE@CVEnewDisclosure

The tweet announces a newly disclosed vulnerability (CVE‑2026‑35635) in OpenClaw’s Synology Chat extension that allows attackers to exploit a webhook path route replacement flaw impacting multi‑account configurations, with no PoC, exploit, or patch mentioned.