CVE-2026-100555 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to a different destination. When attachment delivery accepted a remotely influenced hostname, an attacker could use DNS rebinding to make the NAS fetch a private or otherwise policy-denied resource and return its contents to the addressed conversation (server-side request forgery). Practical impact depends on NAS routing, resolver behavior, and the response available at the private destination. The issue is fixed in 2026.8.1; as a workaround, disable remote URL attachment forwarding in Synology Chat.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within OpenClaw versions greater than or equal to 2026.7.1 and less than 2026.8.1 represents a critical server-side request forgery flaw rooted in flawed DNS validation logic during attachment delivery operations. As an npm-distributed gateway application, OpenClaw facilitates communication between clients and Synology NAS systems via the Synology Chat interface. The core technical deficiency lies in how the Gateway handles domain name resolution for remote file URLs provided by users. When a user supplies a hostname to fetch an external resource, the Gateway performs DNS validation but only validates against a single resolved IP address result rather than ensuring consistent binding throughout the entire request lifecycle. This partial validation creates a discrepancy between the initial check and the subsequent action taken by the Synology NAS backend service responsible for actually retrieving the file content.
The operational mechanism of this exploit relies on DNS rebinding, a technique where an attacker controls or influences the resolution of a domain name to change its target IP address during the course of a connection. In this specific scenario, the Gateway validates that the initial hostname resolves to a permitted public IP address and proceeds with the request flow. However, it passes the original unvalidated hostname string directly to the Synology NAS component for execution. Because DNS resolution is dynamic, an attacker can manipulate their controlled domain's records so that by the time the NAS attempts to fetch the resource, the hostname resolves to an internal private IP address or another destination previously denied by security policies. This effectively bypasses network perimeter defenses and access control lists that rely on static IP filtering, as the validation step was decoupled from the actual request execution context.
The practical impact of this vulnerability is significant for organizations relying on Synology Chat for secure file sharing within private networks. An authenticated attacker who can influence the hostname used in attachment delivery requests could force the NAS to fetch sensitive internal resources such as configuration files, database dumps, or administrative interfaces that are not exposed to the public internet. The retrieved content would then be returned to the addressed conversation channel, leading to a data exfiltration scenario. While the severity of the impact depends on specific network routing configurations and resolver behaviors, the ability to access policy-denied resources constitutes a severe breach of confidentiality and integrity principles. This aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically highlighting weaknesses in input validation where external data influences internal resource selection without adequate verification of the final destination's accessibility or legitimacy.
Furthermore, this vulnerability exhibits characteristics associated with ATT&CK technique T1504.003 Web Service Discovery and potentially T1071 Application Layer Protocol if used to exfiltrate data through standard web channels. The flaw underscores the importance of maintaining strict DNS pinning throughout all stages of a request's lifecycle rather than performing single-point validation at the entry boundary. To mitigate this risk, administrators should immediately upgrade OpenClaw to version 2026.8.1 or later where the issue has been resolved by ensuring consistent hostname resolution and binding checks across both the Gateway and NAS components. For environments unable to patch immediately, a recommended workaround is to disable remote URL attachment forwarding in Synology Chat settings. This restriction prevents users from initiating requests for external resources entirely, thereby eliminating the attack vector while maintaining core chat functionality without exposing internal network assets to potential SSRF exploitation through DNS manipulation.