Listen to this Post
The vulnerability exists in OpenClaw’s QQBot integration, specifically in the direct‑upload media path for `uploadC2CMedia` and `uploadGroupMedia` functions. When a user sends an image URL to be relayed via QQBot, the normal local download path applies SSRF validation to block internal network access or malicious redirects. However, the direct‑upload code path forwards the provided URL as‑is to QQBot’s media API without validating the target. An attacker controlling the QQBot input can supply a crafted URL pointing to internal services (e.g., metadata endpoints, localhost) or an external server they own. OpenClaw then makes an outbound request from its infrastructure to that URL when processing the media upload. Because no SSRF filtering is applied, the QQBot media delivery mechanism may request or relay content from addresses the operator did not intend. The impact is limited to outbound HTTP requests triggered by QQBot media handling; arbitrary local file read is not possible. The flaw affects all versions prior to the fixed release. The patch adds SSRF validation to the direct‑upload code path, reusing the same blocklist and allowlist logic as the local download path. The fix commit is 49db424c8001f2f419aad85f434894d8d85c1a09. The issue was published to GitHub Advisory Database on Apr 21, 2026, reviewed Apr 25, 2026. Severity is low because the requests are outbound only and do not expose secrets inside OpenClaw’s environment beyond what a normal SSRF could reveal (e.g., internal service fingerprints).
dailycve form:
Platform: openclaw npm
Version: < 2026.4.20
Vulnerability: SSRF direct upload
Severity: Low
date: Apr 25 2026
Prediction: already patched 2026.4.20
Analytics under What Undercode Say:
Simulate vulnerable request (pre‑patch)
curl -X POST https://openclaw-instance/qqbot/upload \
-d '{"media_url":"http://169.254.169.254/latest/meta-data/"}' \
-H "Authorization: Bearer $TOKEN"
Check outbound logs for SSRF attempt
grep "outgoing request to" /var/log/openclaw/access.log | grep "169.254.169.254"
Validate fix: direct‑upload SSRF block
curl -X POST https://openclaw-instance/qqbot/upload \
-d '{"media_url":"http://localhost/admin"}' \
-H "Authorization: Bearer $TOKEN" \
| jq '.error' Should return "invalid or blocked URL"
Exploit:
Craft QQBot message with image URL pointing to internal host (e.g., http://10.0.0.1/metrics). Send to OpenClaw instance. Server fetches URL and returns response/metadata in QQBot media relay. Use URL schemes like file://? – blocked by missing local file support but SSRF via HTTP/HTTPS works.
Protection from this CVE
Upgrade to OpenClaw 2026.4.20 or later. If not possible, manually apply SSRF validation to `uploadC2CMedia` and `uploadGroupMedia` functions by adding same blocklist (RFC 1918, 169.254.0.0/16, localhost) before making direct‑upload HTTP calls. Disable QQBot direct‑upload feature if not needed.
Impact:
Attacker causes OpenClaw to make unauthorized outbound requests to internal services (e.g., cloud metadata, internal APIs). No file read or data exfiltration beyond what SSRF allows. Low severity – limited to QQBot channel, outbound only.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
