Skip to content

2026-03-29 — OpenClaw Synology Chat webhook pre-auth rate-limit bypass enables brute-force guessing of webhook token (GHSA-mf5g-6r6f-ghhm)

Product: OpenClaw (npm package: openclaw)

Impact (per advisory): A Synology Chat webhook path allowed pre-auth token guessing without sufficient throttling, making weak webhook tokens practical to brute force.

Why this matters

A webhook token is a bearer secret. If an endpoint allows repeated guesses without backoff, secrecy alone is not enough; the endpoint itself becomes an online guessing target.

  • Patch/upgrade: update to openclaw 2026.3.28 or later.
  • Require high-entropy webhook secrets.
  • Throttle failures with rate limiting, backoff, and temporary lockouts.
  • Keep webhook endpoints off the public internet where possible.

Detection / hunting ideas

  • Alert on bursts of 401/403s against webhook endpoints.
  • Correlate repeated failures with a later success from the same origin.

References