CVE-2026-44117
mediumOpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation.
Vendor / product: Openclaw — openclaw
OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests.
CVSS
5.8
5.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-05-06 20:16
Modified: 2026-11-11 23:10
NVD status: Analyzed
Last synced 3 hours ago
Verified against the source API 2026-11-11 23:13 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
openclaw / openclaw <2026.4.20
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/openclaw/openclaw/commit/49db424c8001f2f419aad85f434894d8d85c1a09
Patch / mitigation: https://github.com/openclaw/openclaw/security/advisories/GHSA-c4qg-j8jg-42q5
References
- https://github.com/openclaw/openclaw/commit/49db424c8001f2f419aad85f434894d8d85c1a09 disclosure@vulncheck.com
- https://github.com/openclaw/openclaw/security/advisories/GHSA-c4qg-j8jg-42q5 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-qqbot-direct-... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗