Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-44117

OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenClaw OpenClaw

Default version status: unaffected

  • 0 to < 2026.4.20affected
  • 2026.4.20unaffected
pkg:npm/openclaw

References