CVE-2026-44117CWE-918

OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload

Medium · published May 6, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-06T19:49Z
EPSS history
Timeline
  • 06 MAY 19:49Z
    OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload
    cvelistv5