Medium severity5.8NVD Advisory· Published May 6, 2026· Updated May 7, 2026

CVE-2026-44117

Description

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.4.20	2026.4.20

Affected products

OpenClaw/Openclawreferences2 versions
(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.4.20
ghsa-coords
pkg:npm/openclaw
Range: < 2026.4.20

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/49db424c8001f2f419aad85f434894d8d85c1a09nvdPatchWEB
github.com/advisories/GHSA-c4qg-j8jg-42q5ghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-c4qg-j8jg-42q5nvdMitigationVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-44117ghsaADVISORY
www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-qqbot-direct-media-uploadnvdThird Party AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.377
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000