Which versions of OpenClaw are affected by CVE-2026-43526?

OpenClaw QQBot versions prior to 2026.4.12 contain a server-side request forgery vulnerability in the media URL handler that allows unauthenticated remote attackers to exfiltrate internal or external…. A patch is available.

How to fix or mitigate CVE-2026-43526?

Within 24 hours: Identify all QQBot deployments and document current versions running in production. Within 7 days: Deploy OpenClaw QQBot version 2026.4.12 or later across all affected instances, prioritizing systems processing sensitive data. Within 30 days: Conduct a security audit of QQBot message logs and data access patterns for the period preceding patch deployment to detect potential data exfiltration.

OpenClaw CVE-2026-43526

Q: What is the CVSS score of CVE-2026-43526?

CVE-2026-43526 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27263 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-05 VulnCheck

SSRF Openclaw

8.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 05, 2026 - 12:52 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 05, 2026 - 12:37 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 12:37 NVD

8.2 (HIGH) 8.3 (HIGH)

Source Code Evidence Fetched

May 05, 2026 - 12:17 vuln.today

Analysis Generated

May 05, 2026 - 12:17 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.12.

DescriptionCVE.org

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.

AnalysisAI

Server-side request forgery in OpenClaw's QQBot media URL handler allows remote unauthenticated attackers to fetch arbitrary internal or external resources and exfiltrate them through the bot's messaging channel. Attackers provide malicious media URLs in QQBot replies, triggering the server to fetch content from attacker-specified locations, which is then re-uploaded through legitimate channels. Vendor patch available as of version 2026.4.12, with fix commits published on GitHub. CVSS 8.3 reflects high confidentiality impact with low integrity impact; CVSS v4.0 vector indicates network-accessible, low complexity attack requiring no privileges or user interaction but specific attack conditions (AT:P).

Technical ContextAI

This vulnerability affects OpenClaw's QQBot integration, specifically the component handling media URLs in bot replies. CWE-918 (Server-Side Request Forgery) occurs when an application accepts user-supplied URLs without proper validation and uses them to initiate server-side requests. In this case, the QQBot reply handler accepts media URLs from external sources, fetches the content server-side, then re-uploads the fetched bytes through the messaging channel. This creates a classic SSRF attack vector where the server acts as a proxy for attacker-controlled requests. The CPE string cpe:2.3:a:openclaw:openclaw identifies this as affecting the OpenClaw application from the openclaw vendor, with the wildcard indicating all versions prior to the patched release are vulnerable.

RemediationAI

Upgrade OpenClaw to version 2026.4.12 or later, which contains patches addressing the SSRF vulnerability in QQBot media URL handling. Two specific fix commits are available for review: commit 08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a and commit ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d at https://github.com/openclaw/openclaw. Consult the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-2767-2q9v-9326 for complete remediation guidance. If immediate patching is not feasible, implement these specific compensating controls: disable QQBot reply media URL processing functionality entirely if not business-critical (eliminates attack surface but breaks media handling in bot replies); implement strict egress filtering to prevent the OpenClaw server from accessing internal networks, cloud metadata endpoints (169.254.169.254, fd00:ec2::254), and localhost (blocks internal SSRF targets but may interfere with legitimate local service dependencies); configure allowlist-based URL validation restricting media URLs to explicitly approved external domains only (reduces attack surface but requires maintenance and may impact legitimate use cases with new media sources). Each mitigation carries operational trade-offs requiring testing before production deployment.