Executive brief
OpenClaw is an AI automation platform with integrations to messaging services like Zalo. The Zalo plugin contains a server-side request forgery (SSRF) vulnerability in its photo-sending feature that fails to validate URLs before sending them to external APIs. An attacker can exploit this to make the server request internal resources or services, potentially exposing sensitive data or enabling lateral movement within a network.
Technical details
OpenClaw's Zalo plugin implements a sendPhoto function that accepts photo URLs as input. The vulnerability is a server-side request forgery (CWE-918) in which photo URLs are forwarded directly to the Zalo Bot API without first being validated against OpenClaw's SSRF hostname policy and guards. This allows an attacker to supply malicious or internal URLs (e.g., localhost, private IP ranges, cloud metadata services) that the server will attempt to fetch on their behalf. The attack requires network access to the application but no authentication. The fix (version 2026.4.22) adds SSRF validation by parsing outbound photo URLs and applying the shared SSRF hostname policy before posting to Zalo, and routes media-reply paths through guarded media helpers.
Affected products
- OpenClaw openclaw <= 2026.4.21
Timeline
- 2026-05-04: disclosed: Published on GitHub advisory database (GHSA-2hh7-c75g-qj2r)
- 2026-04-21: patched: Fix commit a65eb1b authored; version 2026.4.22 released
- 2026-05-04: other: CVE-2026-44116 assigned