OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit …

Published:

27 april 2026 om 22:00:00

Alert date:

28 april 2026 om 20:08:59

Source:

nvd.nist.gov

Web Technologies

OpenClaw versions prior to 2026.4.8 contain a server-side request forgery (SSRF) vulnerability in QQ Bot media download functionality. The vulnerability allows attackers to bypass SSRF protection mechanisms through unprotected media fetch endpoints. Exploitation enables access to internal network resources and circumvention of allowlist security policies. The vulnerability affects the media download paths specifically within the QQ Bot component of OpenClaw. Patches and security advisories have been published to address this issue.

Technical details

Mitigation steps:

Affected products:

OpenClaw