PT-2026-29266 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-03-31 · Updated 2026-04-10 · CVE-2026-34504

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description A server-side request forgery condition exists in the fal provider image-generation-provider.ts component. This allows attackers to retrieve internal URLs. A compromised or malicious fal relay can exploit unprotected image download requests to reveal internal service metadata and responses via the image pipeline.

Recommendations Update to version 2026.3.28 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-34504

GHSA-35CQ-WV6V-88XF

GHSA-QXGF-HMCJ-3XW3

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/commit/80d1e8a11a2ac118c7f7a70bba9c862b6141d928 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qxgf-hmcj-3xw3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34504 · Security Note
• https://osv.dev/vulnerability/GHSA-35cq-wv6v-88xf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qxgf-hmcj-3xw3 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 · Note
• https://vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-image-download-in-fal-provider · Note
• https://twitter.com/vitobotta/status/2042673359540953333 · Twitter Post
• https://twitter.com/CVEnew/status/2039004437507690709 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039227836675023137 · Twitter Post