EUVD-2026-26120Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring low privileges; scope changes to internal systems where confidentiality impact is high and integrity is low.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.
AnalysisAI
Server-side request forgery in OpenClaw's QQ Bot Extension (npm package, all versions before 2026.4.8) allows authenticated users to route media fetch requests through unprotected endpoints, bypassing the configured SSRF guard and allowlist policies. Internal network resources - including metadata services and private APIs - are reachable via the subsequent-system scope change even though the OpenClaw host itself sustains no direct confidentiality impact. No public exploit code or active exploitation has been identified; EPSS stands at 0.03% and SSVC categorizes exploitation status as none.
Technical ContextAI
OpenClaw is a user-controlled local AI assistant distributed as an npm package. Its QQ Bot Extension implements media download functionality intended to route all outbound fetch requests through a centralized SSRF guard (fetchWithSsrFGuard) with DNS-pinning and allowlist enforcement. CWE-918 (Server-Side Request Forgery) is the root cause: specific media download paths within the QQ Bot Extension were not consistently funneled through this guard. Additionally, in TRUSTED_ENV_PROXY mode, DNS-pinning was conditionally skipped even when no proxy environment variable was configured, leaving a path to arbitrary internal hostname resolution. The fix at commit d7c3210 restores DNS-pinning as a mandatory fallback when no proxy env vars are present and adds regression tests covering the TRUSTED_ENV_PROXY boundary. Affected CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* for all versions prior to 2026.4.8.
RemediationAI
Upgrade the openclaw npm package to version 2026.4.8 or later. The vendor-released patch is confirmed by GHSA advisory GHSA-3fv3-6p2v-gxwj and is traceable to commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 at https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Until patching is possible, disable the QQ Bot Extension within OpenClaw to eliminate the vulnerable fetch paths entirely; this removes QQ Bot media functionality as a side effect. Alternatively, restrict OpenClaw's outbound network access via host-level firewall rules to deny connections to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16), preventing SSRF from reaching internal targets while preserving external media fetch capability.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today