CVE-2026-31998: OpenClaw auth bypass enables

CISO Take

CVE-2026-31998 is an authorization bypass in OpenClaw's Synology Chat channel plugin where configuring dmPolicy as an allowlist with an empty allowedUserIds array causes the access check to fail open — any Synology Chat sender can trigger agent dispatch regardless of policy intent. With CVSS 8.6, no privileges required (AV:N/PR:N/AC:L), and EPSS in the top 76th percentile for exploitation likelihood, the attack surface is broad: any organization with an externally reachable Synology Chat feeding into OpenClaw is exposed, and the package's history of 396 prior CVEs signals systemic security debt. The integrity impact is rated High because a bypassed agent executes its full downstream tool chain — file operations, API calls, or system commands — with no authorization check. Organizations running OpenClaw 2026.2.22 or 2026.2.23 with this plugin should patch to either fixed commit (0ee30361 or 7655c0cb), disable the Synology Chat plugin, or set dmPolicy to deny as an immediate workaround.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

HIGH risk for any deployment of OpenClaw with the Synology Chat plugin and a dmPolicy allowlist configuration. The fail-open behavior on empty allowedUserIds is a dangerous secure-by-default failure: operators intending to restrict access inadvertently grant universal access. Attack complexity is Low, no OpenClaw credentials are required, and Synology Chat instances are frequently internet-accessible in enterprise environments. EPSS at the 76th percentile without a public exploit suggests the vulnerability class is well-understood and exploitation tooling may emerge quickly. The package's 396 prior CVEs indicate a pattern of security issues warranting elevated scrutiny of any OpenClaw deployment.

How does the attack unfold?

Initial Access

Attacker obtains Synology Chat sender access — via a legitimate low-privilege account, compromised credentials, or an open guest instance — requiring no OpenClaw-level privileges.

AML.T0049

Authorization Bypass

Attacker sends a message to an OpenClaw-monitored channel; the dmPolicy allowlist check against an empty allowedUserIds array evaluates to true for all senders, granting full authorization by default.

AML.T0049

Unauthorized Agent Dispatch

OpenClaw dispatches an agent in response to the attacker's message, treating the unauthorized sender as a whitelisted principal with full invocation rights.

AML.T0053

Tool Execution and Impact

The dispatched agent executes its full downstream tool chain — file reads, API calls, database queries, or shell commands — achieving confidentiality, integrity, and availability impact within the agent's permission scope.

AML.T0086

Initial Access

Attacker obtains Synology Chat sender access — via a legitimate low-privilege account, compromised credentials, or an open guest instance — requiring no OpenClaw-level privileges.

AML.T0049

Authorization Bypass

Attacker sends a message to an OpenClaw-monitored channel; the dmPolicy allowlist check against an empty allowedUserIds array evaluates to true for all senders, granting full authorization by default.

AML.T0049

Unauthorized Agent Dispatch

OpenClaw dispatches an agent in response to the attacker's message, treating the unauthorized sender as a whitelisted principal with full invocation rights.

AML.T0053

Tool Execution and Impact

The dispatched agent executes its full downstream tool chain — file reads, API calls, database queries, or shell commands — achieving confidentiality, integrity, and availability impact within the agent's permission scope.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I High

A Low

What should I do?

7 steps

Patch immediately: pull commits 0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5 or 7655c0cb3a47d0647cbbf5284e177f90b4b82ddb for OpenClaw 2026.2.22/2026.2.23.
If patching is not immediately possible, disable the synology-chat channel plugin or switch dmPolicy from allowlist to deny mode.
Enforce a non-empty allowedUserIds list as a configuration guard — treat an empty allowlist as a misconfiguration and fail closed.
Audit OpenClaw agent tool permissions: apply least-privilege and remove tools not required for each agent's purpose.
Restrict Synology Chat instance access to internal networks or VPN where possible.
Monitor OpenClaw application logs for agent dispatch events originating from unexpected Synology Chat senders.
Review any other OpenClaw channel plugins for analogous fail-open patterns in policy enforcement logic.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084.002 - Activation Triggers AML.T0108 - AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2.6 - Controls for AI system access and authorization

NIST AI RMF

GOVERN 1.2 - Accountability structures for AI risk

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-31998?

CVE-2026-31998 is an authorization bypass in OpenClaw's Synology Chat channel plugin where configuring dmPolicy as an allowlist with an empty allowedUserIds array causes the access check to fail open — any Synology Chat sender can trigger agent dispatch regardless of policy intent. With CVSS 8.6, no privileges required (AV:N/PR:N/AC:L), and EPSS in the top 76th percentile for exploitation likelihood, the attack surface is broad: any organization with an externally reachable Synology Chat feeding into OpenClaw is exposed, and the package's history of 396 prior CVEs signals systemic security debt. The integrity impact is rated High because a bypassed agent executes its full downstream tool chain — file operations, API calls, or system commands — with no authorization check. Organizations running OpenClaw 2026.2.22 or 2026.2.23 with this plugin should patch to either fixed commit (0ee30361 or 7655c0cb), disable the Synology Chat plugin, or set dmPolicy to deny as an immediate workaround.

Is CVE-2026-31998 actively exploited?

No confirmed active exploitation of CVE-2026-31998 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31998?

1. Patch immediately: pull commits 0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5 or 7655c0cb3a47d0647cbbf5284e177f90b4b82ddb for OpenClaw 2026.2.22/2026.2.23. 2. If patching is not immediately possible, disable the synology-chat channel plugin or switch dmPolicy from allowlist to deny mode. 3. Enforce a non-empty allowedUserIds list as a configuration guard — treat an empty allowlist as a misconfiguration and fail closed. 4. Audit OpenClaw agent tool permissions: apply least-privilege and remove tools not required for each agent's purpose. 5. Restrict Synology Chat instance access to internal networks or VPN where possible. 6. Monitor OpenClaw application logs for agent dispatch events originating from unexpected Synology Chat senders. 7. Review any other OpenClaw channel plugins for analogous fail-open patterns in policy enforcement logic.

What systems are affected by CVE-2026-31998?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat-integrated AI agents, enterprise AI automation pipelines.

What is the CVSS score for CVE-2026-31998?

CVE-2026-31998 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

agent frameworkschat-integrated AI agentsenterprise AI automation pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084.002 Activation Triggers

AML.T0108 AI Agent

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks and trigger unauthorized agent dispatch and downstream tool actions.

Exploitation Scenario

An adversary with access to a Synology Chat instance — either as a legitimate low-privilege user, via compromised credentials, or through an open guest chat — identifies a channel monitored by an OpenClaw agent. The organization has configured dmPolicy as allowlist intending to restrict agent invocation to approved users, but allowedUserIds is empty (a misconfiguration that is easy to make and likely common on initial setup). The attacker sends a crafted message; the plugin evaluates the allowlist, finds no entries, and fails open — granting the attacker's message the same authorization as a whitelisted sender. OpenClaw dispatches the agent, which proceeds to invoke its configured downstream tools. Depending on the agent's tool configuration, the attacker may read sensitive files, query internal APIs, exfiltrate data to an external endpoint, or pivot to other systems reachable by the agent's credentials.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.