Is CVE-2026-100572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100572 being exploited in the wild.

How severe is CVE-2026-100572?

Medium severity, with a CVSS score of 5.3, published 26 September 2026.

Which products and versions are affected?

Openclaw >= 2026.3.25, < 2026.8.1.

Is there a fix for CVE-2026-100572?

A patch was published on 2026-08-01: Fix released in version 2026.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100572 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100572?

Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100572: OpenClaw rate-limit bypass in Synology Chat webhooks

Q: Is there a fix for CVE-2026-100572?

A patch was published on 2026-08-01: Fix released in version 2026.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-100572 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-100572?

Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100572 · Severity: medium · CVSS 5.3 · Published 2026-09-26

OpenClaw is a platform that integrates Synology Chat webhooks for messaging automation. In affected versions, an attacker can bypass authentication rate-limiting by exhausting a shared request budget, causing legitimate webhook messages to be rejected until the rate-limit window resets. This results in temporary unavailability of automated chat notifications but does not expose credentials or message data.

Technologies: Openclaw. Vendors: Openclaw.

Quick answers

Is CVE-2026-100572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100572 being exploited in the wild.
How severe is CVE-2026-100572?: Medium severity, with a CVSS score of 5.3, published 26 September 2026.
Which products and versions are affected?: Openclaw >= 2026.3.25, < 2026.8.1.
Is there a fix for CVE-2026-100572?: A patch was published on 2026-08-01: Fix released in version 2026.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100572 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100572?: Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in invalid-token rate-limiting logic that executes before authentication and keys the limit to the raw proxy socket address rather than per-client identity. In configurations where OpenClaw sits behind a reverse proxy with multiple external clients sharing one source address, an unauthenticated attacker can flood the endpoint with invalid tokens to exhaust the shared budget, causing subsequent legitimate Synology Chat callbacks to be rate-limited. The attacker cannot obtain valid tokens or access message content.

Affected products

OpenClaw OpenClaw >= 2026.3.25, < 2026.8.1

Timeline

2026-09-26: disclosed
2026-08-01: patched: Fix released in version 2026.8.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.