Openclaw cli: OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution. (CVE-2026-35670)

The Synology Chat reply delivery mechanism in the OpenClaw CLI package could rebind replies to a mutable username match rather than the stable numeric user_id recorded by the webhook event. This could lead to incorrect reply delivery if usernames are changed or duplicated. The vulnerability affects versions before 2026.3.22 and was addressed by changes in webhook-handler.ts and config-schema.ts to maintain binding to the stable user identifier unless a dangerous opt-in is explicitly enabled.

The vulnerability could allow reply messages in Synology Chat to be delivered to an unintended user if username-based resolution is used instead of the stable numeric user_id. This may result in partial confidentiality loss (high confidentiality impact) and limited integrity impact due to misdirected replies. There is no impact on availability. The CVSS score is 5.9 (medium severity).

A fix is available and was shipped in OpenClaw CLI version 2026.3.22 and later. Users should upgrade to version 2026.3.22 or newer to mitigate this issue. The fix ensures replies are bound to the stable webhook user identifier by default, with username rebinding requiring explicit opt-in.