CVE-2026-44116CWE-918

OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation

Medium · published May 6, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo Bot API, enabling unauthorized access to internal resources.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-06T19:49Z
EPSS history
Timeline
  • 06 MAY 19:49Z
    OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation
    cvelistv5