by Kastro
Paper/Archive/CVE-2026-43526

CVE-2026-43526

OpenClaw OpenClaw — OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
31
CVSS 9.3 (NVD)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 16.5.165 × 203.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.4.122026.4.12CNA

Scores by source

NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
VulnCheck (CNA)8.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-2767-2q9v-9326patchgithub.com/openclaw/openclaw/commit/08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95apatchgithub.com/openclaw/openclaw/commit/ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2dwriteupvulncheck.com/advisories/openclaw-server-side-request-forgery-via-qqbot-reply-media-url-handling