CVE-2026-100555

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.1 through 2026.8.0

Description Synology Chat attachment delivery fails to maintain DNS pinning. The Gateway validates a single DNS result for a provided file URL but transmits the original hostname to the Synology NAS, which may resolve to a different destination. This allows an attacker to use DNS rebinding—a technique used to bypass the Same-Origin Policy—to force the NAS to fetch a private or policy-denied resource and return its contents to the conversation, resulting in server-side request forgery (SSRF), where the server is coerced into making unauthorized requests.

Recommendations Update to version 2026.8.1. Disable remote URL attachment forwarding in Synology Chat.