CVE-2026-35635: OpenClaw webhook route hijack

CISO Take

CVE-2026-35635 is a webhook path route replacement flaw in OpenClaw's Synology Chat extension that allows unauthenticated remote attackers to hijack route ownership across accounts in multi-account deployments, collapsing per-account DM access control policies onto shared webhook paths. While the CVSS score sits at a moderate 4.8, the EPSS 85th percentile signals above-average exploitation likelihood for a vulnerability with no public exploit yet — and OpenClaw's track record of 396 CVEs paired with a package risk score of 0/100 marks this as a historically under-secured component with persistent attack surface. No privileges or user interaction are required once the path-collision condition exists, making this a meaningful data-exposure risk in any multi-tenant AI agent deployment where agents relay sensitive communications or security alerts via Synology Chat. Upgrade to OpenClaw ≥2026.3.22 immediately; if patching is delayed, disable the Synology Chat extension and audit all webhook path assignments for unauthorized route changes.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Moderate exploitability with meaningful data-exposure potential in multi-account deployments. Attack complexity is HIGH per CVSS — exploitation requires finding or inducing duplicate/inherited webhook paths — but no privileges or user interaction are required once that condition is met. The EPSS 85th percentile is the primary escalating factor, signaling that this vulnerability class is actively studied even without a public PoC. Blast radius is constrained by 4 downstream dependents, but the 0/100 package risk score and 396 historical CVEs indicate a component with systemic security debt. Organizations running multi-account OpenClaw deployments with Synology Chat integration face the highest exposure.

How does the attack unfold?

Reconnaissance

Attacker identifies a target OpenClaw deployment using Synology Chat with multi-account configuration and discovers shared or inherited webhook path identifiers across accounts.

AML.T0084

Route Manipulation

Attacker exploits the webhook path route replacement flaw by registering a duplicate or inherited path before the legitimate account finalizes configuration, triggering ownership collapse onto the attacker's endpoint.

AML.T0049

Access Control Bypass

Per-account DM access control policies are circumvented as all victim-account messages are now routed to the attacker-controlled webhook, invalidating OpenClaw's account isolation guarantees.

AML.T0107

Data Interception & Injection

Attacker intercepts all DMs routed to the hijacked webhook, exfiltrating agent communications and sensitive data, and optionally injects crafted messages upstream to manipulate agent behavior.

AML.T0025

Reconnaissance

Attacker identifies a target OpenClaw deployment using Synology Chat with multi-account configuration and discovers shared or inherited webhook path identifiers across accounts.

AML.T0084

Route Manipulation

Attacker exploits the webhook path route replacement flaw by registering a duplicate or inherited path before the legitimate account finalizes configuration, triggering ownership collapse onto the attacker's endpoint.

AML.T0049

Access Control Bypass

Per-account DM access control policies are circumvented as all victim-account messages are now routed to the attacker-controlled webhook, invalidating OpenClaw's account isolation guarantees.

AML.T0107

Data Interception & Injection

Attacker intercepts all DMs routed to the hijacked webhook, exfiltrating agent communications and sensitive data, and optionally injects crafted messages upstream to manipulate agent behavior.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.3.22 or later (patches in commits 630f1479 and 980940aa per the GitHub advisory).
Immediate workaround: Disable the Synology Chat extension on all OpenClaw instances until patching is complete.
Audit: Review all configured webhook paths for duplicate or inherited entries across accounts; revoke and regenerate paths for any accounts sharing a path identifier.
Detection: Monitor webhook endpoint logs for cross-account route changes or unexpected ownership transfers; alert on any webhook path update not initiated by the account owner.
Isolation: Enforce unique, non-inheritable webhook paths per account and restrict webhook configuration to authenticated account administrators.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Data Extraction Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration AML.T0084 - Discover AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

GOVERN 6.2 - Policies, processes, procedures, and practices are in place to address risks and opportunities

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-35635?

CVE-2026-35635 is a webhook path route replacement flaw in OpenClaw's Synology Chat extension that allows unauthenticated remote attackers to hijack route ownership across accounts in multi-account deployments, collapsing per-account DM access control policies onto shared webhook paths. While the CVSS score sits at a moderate 4.8, the EPSS 85th percentile signals above-average exploitation likelihood for a vulnerability with no public exploit yet — and OpenClaw's track record of 396 CVEs paired with a package risk score of 0/100 marks this as a historically under-secured component with persistent attack surface. No privileges or user interaction are required once the path-collision condition exists, making this a meaningful data-exposure risk in any multi-tenant AI agent deployment where agents relay sensitive communications or security alerts via Synology Chat. Upgrade to OpenClaw ≥2026.3.22 immediately; if patching is delayed, disable the Synology Chat extension and audit all webhook path assignments for unauthorized route changes.

Is CVE-2026-35635 actively exploited?

No confirmed active exploitation of CVE-2026-35635 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35635?

1. Patch: Upgrade OpenClaw to version 2026.3.22 or later (patches in commits 630f1479 and 980940aa per the GitHub advisory). 2. Immediate workaround: Disable the Synology Chat extension on all OpenClaw instances until patching is complete. 3. Audit: Review all configured webhook paths for duplicate or inherited entries across accounts; revoke and regenerate paths for any accounts sharing a path identifier. 4. Detection: Monitor webhook endpoint logs for cross-account route changes or unexpected ownership transfers; alert on any webhook path update not initiated by the account owner. 5. Isolation: Enforce unique, non-inheritable webhook paths per account and restrict webhook configuration to authenticated account administrators.

What systems are affected by CVE-2026-35635?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI agent deployments, AI agent webhook integrations.

What is the CVSS score for CVE-2026-35635?

CVE-2026-35635 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI agent deploymentsAI agent webhook integrations

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 6.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account DM access control policies and replace route ownership across accounts.

Exploitation Scenario

An attacker targeting an organization running OpenClaw in a multi-account Synology Chat deployment enumerates or induces the creation of duplicate webhook paths — a condition arising from account cloning, template reuse, or inherited configurations. The attacker registers a new webhook at an identical path before the legitimate account completes configuration, triggering the route replacement logic and claiming ownership. All Synology Chat DMs destined for the victim account's OpenClaw agent are subsequently routed to the attacker's endpoint. If the agent processes security alerts, incident notifications, or sensitive operational queries via DM, the attacker achieves persistent interception of that data stream. The attacker may also inject crafted messages upstream into the agent's input queue, potentially coercing the agent into executing unintended tool calls or leaking context from prior conversations.

Weaknesses (CWE)

CWE-706 Use of Incorrectly-Resolved Name or Reference

CWE-706 — Use of Incorrectly-Resolved Name or Reference: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Source: MITRE CWE corpus.