Technical impact
An invalid token rate limiting mechanism in OpenClaw is applied to Synology Chat webhooks before authentication is established. By sending unauthenticated requests, an attacker can deplete the shared invalid-token budget allocated per raw proxy socket address. Consequently, legitimate webhook callbacks from Synology Chat are rejected until the rate‑limit window resets. No valid token is obtained and no message data is accessed; the impact is a temporary loss of available channel service.
Affected Systems
OpenClaw software, versions from 2026.3.25 up to but not including 2026.8.1, run behind a trusted reverse proxy or tunnel where multiple external clients share a single socket address. The vulnerability has been fixed as of OpenClaw 2026.8.1.
Risk and Exploitability
The CVSS score of 6.9 denotes a moderate severity. Since the EPSS score is not available, the exploit probability cannot be quantified, and the vulnerability is not noted in the CISA KEV catalog. The likely attack vector is a remote unauthenticated request to the webhook endpoint; an attacker needs only to send repeated requests to exhaust the rate limiter. Given the moderate CVSS and lack of exploitation data, the risk remains moderate but actionable.
