Description
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.4.8 | 2026.4.8 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | < 2026.4.8 | 2026.4.8 | GHSA-3fv3-6p2v-gxwj |
Advisories 1
- WID-SEC-2026-1035 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
References
- GitHub Security Advisory (GHSA-3fv3-6p2v-gxwj) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths third-party-advisory