PT-2026-38250 · Openclaw · Openclaw

Foodlook · Published 2026-04-25 · Updated 2026-05-07 · CVE-2026-44117

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.20

Description An issue in QQBot direct media upload allows for server-side request forgery (SSRF), a flaw where a server is tricked into making requests to an unintended location. This occurs because URL validation is skipped. Attackers can bypass protections by sending crafted image URLs to the 'uploadC2CMedia' and 'uploadGroupMedia' endpoints to relay unauthorized requests.

Recommendations Update to version 2026.4.20. As a temporary workaround, restrict access to the 'uploadC2CMedia' and 'uploadGroupMedia' endpoints to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-44117

GHSA-C4QG-J8JG-42Q5

GHSA-R747-33R4-RMJW

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/commit/49db424c8001f2f419aad85f434894d8d85c1a09 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-c4qg-j8jg-42q5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44117 · Security Note
• https://osv.dev/vulnerability/GHSA-c4qg-j8jg-42q5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r747-33r4-rmjw · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/CVEtracker/52911 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2052128247815569802 · Twitter Post
• https://twitter.com/CVEnew/status/2052430103376699480 · Twitter Post
• https://t.me/cveNotify/162593 · Telegram Post
• https://vulncheck.com/advisories/openclaw-server-side-request-forgery-in-qqbot-direct-media-upload · Note