Executive brief
OpenClaw is a local AI assistant that includes a QQ Bot extension for downloading media files. The extension fails to validate where media files are downloaded from, allowing attackers to force the application to fetch files from internal or restricted servers. This could lead to unauthorized access to internal services, credential theft, or data exposure from systems that should not be accessible.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF, CWE-918) in the OpenClaw QQ Bot extension's media download functionality. The affected media fetch paths bypass the application's SSRF guard and allowlist policy, allowing an attacker to craft requests that cause the extension to retrieve files from attacker-controlled or internal URLs. OpenClaw is designed as a user-controlled local assistant and does not assume a multi-tenant service boundary; exploitation requires local or direct access to manipulate media download requests. An attacker can force the application to connect to internal services, retrieve sensitive files, or probe the local network. The vulnerability was fixed in version 2026.4.8 (commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5), with verified regression tests confirming the security boundary fix.
Affected products
- OpenClaw openclaw <= 2026.4.2
Timeline
- 2026-04-09: disclosed
- 2026-04-08: patched: Fix available in version 2026.4.8