PT-2026-35796 · Openclaw · Openclaw

Adithyan Ak · Published 2026-04-09 · Updated 2026-04-29 · CVE-2026-41914

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description An issue exists in the QQ Bot media download paths that allows for server-side request forgery (SSRF), a flaw where an attacker can induce the server to make requests to an unintended location. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.

Recommendations Update to version 2026.4.8.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41914

GHSA-3FV3-6P2V-GXWJ

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3fv3-6p2v-gxwj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41914 · Security Note
• https://osv.dev/vulnerability/GHSA-3fv3-6p2v-gxwj · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2049227507057021387 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049304018896253218 · Twitter Post
• https://vulncheck.com/advisories/openclaw-server-side-request-forgery-in-qq-bot-media-fetch-paths · Note