Is there a patch available for CVE-2026-62216?

Yes, a patch is available for CVE-2026-62216. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-62216

Q: What is the CVSS score of CVE-2026-62216?

CVE-2026-62216 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45104 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-17 VulnCheck

GHSA-2x38-rcq4-g4qr

SSRF Openclaw

2.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

AT:P in CVSS 4.0 maps to AC:H; PR:L for required authenticated lower-trust caller; S:C for SSRF reaching subsequent systems with low confidentiality exposure only.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:05 vuln.today

DescriptionCVE.org

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (server-side request forgery). The practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

AnalysisAI

OpenClaw's QQBot media upload feature fails to enforce network-destination policy for lower-trust callers, enabling server-side requests to reach internal or blocked network addresses. Versions 2026.4.20 up to (but not including) 2026.5.28 are affected; the CVSS 4.0 score of 2.3 reflects that practical impact is tightly bounded by operator configuration - only subsequent-system confidentiality at a Low level is indicated (SC:L), with no direct impact to the vulnerable component itself. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes vulnerabilities where a server-side component accepts user-influenced input to construct outbound network requests without adequate validation or policy enforcement. In this instance, OpenClaw's QQBot integration exposes a media upload path that passes caller-supplied destination URLs through a policy filter; that filter can be circumvented by lower-trust principals or via a configured input path, allowing outbound requests to reach destinations the operator intended to block. The affected software is identified by CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, covering versions in the 2026.4.20 release line up to the 2026.5.28 patch. SSRF in bot-integration upload features is a well-understood attack class: they frequently run with server-side network privileges that exceed what the caller should be able to exercise, making policy bypass a meaningful trust boundary violation even when direct confidentiality or integrity impact to the host system is absent.

RemediationAI

Upgrade OpenClaw to version 2026.5.28 or later, which contains the vendor-released fix as documented in the GitHub security advisory GHSA-fwgr-fpv9-vf5x (https://github.com/openclaw/openclaw/security/advisories/GHSA-fwgr-fpv9-vf5x). If an immediate upgrade is not feasible, restrict access to the QQBot media upload endpoint to the highest-trust principals only, removing lower-trust callers from the code path - this directly eliminates the privilege condition (PR:L) required for exploitation. Additionally, implement egress firewall rules or OS-level network policies on the OpenClaw host to block outbound connections to sensitive internal destinations (e.g., cloud metadata endpoints at 169.254.169.254, internal API ranges), which limits what a successful SSRF can actually reach regardless of the application-layer policy bypass. Note that egress filtering is a compensating control and not a substitute for patching, as creative attackers may redirect through allowed destinations.