PT-2026-60626 · Openclaw · Openclaw
CVE-2026-62216
·
Published
2026-07-17
·
Updated
2026-07-23
CVSS v3.1
5.0
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions 2026.4.20 through 2026.5.27
Description
A policy bypass exists in the QQBot media upload feature. A lower-trust caller or a configured input path can cause media uploads to reach network destinations that should be blocked by the OpenClaw policy, leading to Server-Side Request Forgery (SSRF), which is a flaw where an attacker can induce the server to make requests to an unintended location.
Recommendations
Update OpenClaw to version 2026.5.28.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openclaw