CVE-2026-44117

Medium

Open

TLP:CLEAR

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests.

Details

CVSS Score: 5.8
EPSS Score ⓘ: 0.24%

14.8th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Confidence: 90%
Published: May 6, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.