Openclaw cli: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token (CVE-2026-35646)

The openclaw-cli package used for Synology Chat webhook authentication did not throttle repeated invalid token guesses before authentication failure responses. This lack of rate limiting allowed attackers to brute-force weak webhook tokens. The vulnerability was verified in version 2026.3.24 and fixed in commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c, which introduced throttling to prevent repeated guess attempts. The affected versions are from 2026.1.29 up to but not including 2026.3.28, with the first patched version being 2026.3.25.

Attackers can perform brute-force attacks on webhook tokens due to the absence of rate limiting on invalid token attempts. This could lead to unauthorized access or triggering of webhook actions if weak tokens are used. The impact is limited to the ability to guess webhook tokens, which depends on token strength.

A patch is available and should be applied by upgrading openclaw-cli to version 2026.3.25 or later. The fix adds throttling on repeated invalid token guesses, mitigating brute-force attempts. Users should update to the fixed version to prevent exploitation.