115 matches found
CVE-2026-100572
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100555
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100572
OpenClaw versions >= 2026.3.25 and
CVE-2026-100572
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
EUVD-2026-87479
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100555
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100555
The OpenClaw npm-distributed gateway application (versions >= 2026.7.1 and
EUVD-2026-87495
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
CVE-2026-100555: Server-Side Request Forgery (SSRF)
OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...
PT-2026-99192
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.1 through 2026.8.0 Description Synology Chat attachment delivery fails to maintain DNS pinning. The Gateway validates a single DNS result for a provided file URL but transmits the original hostname to the Synology NAS,...
PT-2026-99208
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.3.25 through 2026.8.0 Description Invalid-token rate limiting for Synology Chat webhooks is applied before authentication and is keyed on the raw proxy socket address. In environments where the software is positioned...
CVE-2026-100572: Uncontrolled Resource Consumption
OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...
CVE-2026-9548
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...