Skip to main content

OpenClaw QQBot CVE-2026-44117

| EUVDEUVD-2026-28199 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-05-06 disclosure@vulncheck.com
SSRF Openclaw
6.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
May 06, 2026 - 21:03 EUVD
Source Code Evidence Fetched
May 06, 2026 - 20:37 vuln.today
Analysis Generated
May 06, 2026 - 20:37 vuln.today
CVE Published
May 06, 2026 - 20:16 nvd
MEDIUM 6.3

DescriptionCVE.org

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests.

AnalysisAI

Server-side request forgery in OpenClaw before 2026.4.20 allows unauthenticated remote attackers to relay unintended requests through QQBot direct media upload endpoints (uploadC2CMedia and uploadGroupMedia) by sending crafted image URLs that bypass SSRF protections. The vulnerability affects QQBot outbound media handling and does not expose arbitrary local files, but could allow attackers to make configured QQBot media delivery requests to unintended destinations.

Technical ContextAI

OpenClaw's QQBot extension implements direct media upload functionality through uploadC2CMedia and uploadGroupMedia API endpoints that accept image URLs for relay to QQ's media servers. The vulnerability exists in CWE-918 (Server-Side Request Forgery) where the direct-upload code path failed to apply the SSRF validation guard (resolvePinnedHostnameWithPolicy and fetchWithSsrFGuard from openclaw/plugin-sdk/ssrf-runtime) that was correctly implemented in the local download path. The fix introduces hostname resolution policy checks to block private/internal/special-use IP addresses (including 169.254.x.x metadata endpoints) and enforces HTTPS-only URLs before making upstream requests to QQ's media servers.

RemediationAI

Upgrade OpenClaw to version 2026.4.20 or later, which includes fix commit 49db424c8001f2f419aad85f434894d8d85c1a09. The patch adds SSRF validation guards (resolvePinnedHostnameWithPolicy and fetchWithSsrFGuard) to both uploadC2CMedia and uploadGroupMedia endpoints, blocks requests to private/internal IP ranges including AWS metadata endpoints (169.254.169.254), and enforces HTTPS-only direct-upload URLs. Organizations using prior versions should immediately update via npm. No workarounds are available for unpatched versions; network-level restrictions on outbound QQBot media requests can provide temporary defense-in-depth but do not substitute for patching.

More in Openclaw

View all
CVE-2026-28446 CRITICAL POC
9.4 Mar 05

Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
CVE-2026-33579 CRITICAL POC
9.4 Mar 31

Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
CVE-2026-32042 HIGH POC
8.8 Mar 21

OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
CVE-2026-32051 HIGH POC
8.8 Mar 21

An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
CVE-2026-25253 HIGH POC
8.8 Feb 01

OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
CVE-2026-32846 HIGH POC
8.7 Mar 26

Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
CVE-2026-32064 HIGH POC
7.7 Mar 21

OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
CVE-2026-32055 HIGH POC
7.6 Mar 21

OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
CVE-2026-32056 HIGH POC
7.5 Mar 21

OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
CVE-2026-32049 HIGH POC
7.5 Mar 21

OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
CVE-2026-32048 HIGH POC
7.5 Mar 21

OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low

CVE-2026-25474 HIGH POC
7.5 Feb 19

OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2023-48022 CRITICAL POC
9.8
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5
CVE-2015-8813 HIGH POC
8.2
CVE-2020-24881 CRITICAL POC
9.8
CVE-2026-15409 CRITICAL POC
10.0
CVE-2024-54385 HIGH POC
7.2
CVE-2022-45835 MEDIUM POC
5.8
CVE-2024-54330 HIGH POC
7.2
CVE-2026-20230 HIGH POC
8.6

Share

CVE-2026-44117 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy