VYPR
← All advisories
Medium severity5.0NVD Advisory· Published Jul 17, 2026· Updated Jul 23, 2026

CVE-2026-62216

CVE-2026-62216

Description

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (server-side request forgery). The practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Affected products

2
  • OpenClaw/Openclawllm-fuzzy2 versions
    <2026.5.28+ 1 more
    • (no CPE)range: <2026.5.28
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: >=2026.4.20,<2026.5.28

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.