Executive brief
OpenClaw is an open-source automation or bot framework. A security flaw in its Zalo plugin allows attackers to trick the server into making unauthorized requests to internal systems by providing malicious photo URLs. This could lead to the exposure of sensitive internal data or unauthorized access to private network resources.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in OpenClaw versions prior to 2026.4.22 within the Zalo plugin's sendPhoto function. The root cause is a failure to validate outbound photo URLs against the application's SSRF guard policy before forwarding them to the Zalo Bot API. A remote, unauthenticated attacker can exploit this by providing a specially crafted URL, causing the server to perform requests to internal network resources that are otherwise unreachable from the internet. This can result in unauthorized information disclosure from internal services. The issue is fixed in version 2026.4.22 by enforcing the shared SSRF hostname policy on all outbound photo URLs.
Affected products
- OpenClaw openclaw < 2026.4.22
Timeline
- 2026-04-23: advisory: Original vendor advisory GHSA-2hh7-c75g-qj2r published
- 2026-04-22: patched: Version 2026.4.22 released with fix
- 2026-05-06: disclosed: CVE-2026-44116 assigned and published to NVD