CVE-2026-43526: OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-05 · updated 2026-06-17
Weakness: CWE-918

Description

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.

Affected products

OpenClaw: before 2026.4.12 — fixed in 2026.4.12

How to fix

Upgrade to a fixed version: OpenClaw 2026.4.12. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a
https://github.com/openclaw/openclaw/commit/ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d
https://github.com/openclaw/openclaw/security/advisories/GHSA-2767-2q9v-9326
https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-qqbot-reply-media-url-handling

Get alerted when CVE-2026-43526 or the next vulnerability affects your stack