CVE-2026-100555
Received Received - Intake

OpenClaw Gateway DNS Pinning Bypass via Synology Chat

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to a different destination. When attachment delivery accepted a remotely influenced hostname, an attacker could use DNS rebinding to make the NAS fetch a private or otherwise policy-denied resource and return its contents to the addressed conversation (server-side request forgery). Practical impact depends on NAS routing, resolver behavior, and the response available at the private destination. The issue is fixed in 2026.8.1; as a workaround, disable remote URL attachment forwarding in Synology Chat.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100555
EUVD
EUVD-2026-87495

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
synology chat From 2026.7.1 (inc) to 2026.8.1 (exc)
synology chat 2026.8.1
openclaw openclaw From 2026.7.1 (inc) to 2026.8.1 (exc)
openclaw openclaw 2026.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenClaw, an npm-distributed gateway application. It allows DNS rebinding via attachment delivery in versions between 2026.7.1 and 2026.8.1. The gateway validates a single DNS result for a file URL but passes the original hostname to Synology NAS, which may resolve to a different destination. An attacker could exploit this to make the NAS fetch private or restricted resources and return them to a conversation.

Detection Guidance

To detect this vulnerability, check the version of OpenClaw installed on your system. If it is between 2026.7.1 and 2026.8.1, the system is vulnerable. Use commands like 'npm list openclaw' or check the package.json file to verify the version.

Impact Analysis

An attacker could use DNS rebinding to trick the Synology NAS into fetching private or policy-denied resources and returning their contents to a conversation. Impact depends on NAS routing, resolver behavior, and the response available at the private destination. The vulnerability enables server-side request forgery (SSRF).

Compliance Impact

This vulnerability could lead to unauthorized access to private or sensitive data stored on the NAS, potentially violating GDPR (data protection) and HIPAA (health information privacy) compliance. Unauthorized data exposure may result in regulatory penalties or breaches of confidentiality requirements.

Mitigation Strategies

Immediately upgrade OpenClaw to version 2026.8.1 or later. As a temporary workaround, disable remote URL attachment forwarding in Synology Chat settings until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart