Is there a patch available for CVE-2026-34504?

Yes, a patch is available for CVE-2026-34504. Update the affected software to the latest version immediately.

Openclaw CVE-2026-34504

Q: What is the CVSS score of CVE-2026-34504?

CVE-2026-34504 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17471 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-31 VulnCheck

SSRF Openclaw

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 14:30 euvd

EUVD-2026-17471

Analysis Generated

Mar 31, 2026 - 14:30 vuln.today

Patch released

Mar 31, 2026 - 14:30 nvd

Patch available

CVE Published

Mar 31, 2026 - 14:10 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded image download fetches to expose internal service metadata and responses through the image pipeline.

AnalysisAI

Server-side request forgery in OpenClaw before 2026.3.28 allows unauthenticated remote attackers to fetch internal URLs through unguarded image download operations in the fal provider image-generation-provider.ts component, enabling exposure of internal service metadata and responses via the image pipeline. CVSS 5.3 indicates moderate integrity impact without authentication requirements. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

OpenClaw's fal relay provider component implements image generation and download functionality via the image-generation-provider.ts module. The vulnerability stems from insufficient validation of URLs passed to image fetch operations (CWE-918: Server-Side Request Forgery), allowing an attacker to manipulate the relay into requesting arbitrary internal URLs. The fal relay-either malicious or compromised-can leverage these unguarded fetch calls to access internal service endpoints that would normally be restricted to local/trusted clients. The SSRF originates in the image pipeline's handling of download requests, where URL validation is absent or insufficient, permitting attackers to reach internal metadata services, private APIs, or configuration endpoints.

RemediationAI

Upgrade to OpenClaw 2026.3.28 or later, which includes the patch committed at 80d1e8a11a2ac118c7f7a70bba9c862b6141d928. Vendor advisory details are available at https://github.com/openclaw/openclaw/security/advisories/GHSA-qxgf-hmcj-3xw3. For deployment environments unable to upgrade immediately, implement network-level controls to restrict outbound connections from OpenClaw fal relay instances to known-safe internal service endpoints, and validate all URLs passed to image download operations to prevent SSRF attacks. Comprehensive patch and advisory information is available via VulnCheck at https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-image-download-in-fal-provider.