CVE-2026-43526 HIGH

CVE-2026-43526: OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling

Vendor Openclaw
Product OpenClaw
Weakness CWE-918 · SSRF
Published May 5, 2026
Last update May 5, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.

Key dates

02Disclosure timeline

May 5, 2026 CVE published
May 5, 2026 Record updated