CVE-2026-31998
Last modified
CVE-2026-31998 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks and trigger unauthorized agent dispatch and downstream tool actions.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks and trigger unauthorized agent dispatch and downstream tool actions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | >= 2026.2.22, < 2026.2.24 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-gw85-xp4q-5gp9Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-31998?
How severe is CVE-2026-31998?
How do I fix CVE-2026-31998?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-31992OpenClaw versions prior to 2026.2.23 contain an allowlist by…8.8
- CVE-2026-31993OpenClaw versions prior to 2026.2.22 contain an allowlist pa…6.4
- CVE-2026-31994OpenClaw versions prior to 2026.2.19 contain a local command…7.8
- CVE-2026-31995OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a com…7
- CVE-2026-31996OpenClaw versions prior to 2026.2.19 tools.exec.safeBins con…4.4
- CVE-2026-31997OpenClaw versions prior to 2026.3.1 fail to pin executable i…6.7
- CVE-2026-31999OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows con…7.8
- CVE-2026-3200A vulnerability was identified in z-9527 admin 1.0/2.0. The …7.3
- CVE-2026-32000OpenClaw versions prior to 2026.2.19 contain a command injec…7.1
- CVE-2026-32001OpenClaw versions prior to 2026.2.22 contain an authenticati…5.4
- CVE-2026-32002OpenClaw versions prior to 2026.2.23 contain a sandbox bypas…6.5
- CVE-2026-32003OpenClaw versions prior to 2026.2.22 contain an environment …7.2
Are you affected by CVE-2026-31998?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST