PT-2026-35796 · Openclaw · Openclaw

Adithyan Ak · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41914

NVD

CVSS v3.1

8.5

High

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41914

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3fv3-6p2v-gxwj · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41914 · Security Note
• https://vulncheck.com/advisories/openclaw-server-side-request-forgery-in-qq-bot-media-fetch-paths · Note
• https://twitter.com/CVEnew/status/2049227507057021387 · Twitter Post