High
OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling
Type: advisorySources: OSV
OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-43526
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 02:32 UTC · Revision 1
Source evidence
OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling
core-osv · Original sourcePublished 5 May 2026, 11:24 UTC
OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.
osv:CVE-2026-43526
Complete source record
{
"id": "599ca0340ee4ccc7391dd722b3eae1577c237adadaaf942b08185e0cb47a116a",
"url": "https://osv.dev/vulnerability/CVE-2026-43526",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling",
"summary": "OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.",
"evidence": "osv:CVE-2026-43526",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-43526",
"aliases": [
"CVE-2026-43526",
"GHSA-2767-2q9v-9326"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openclaw/openclaw",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1c0672b74f66038fd4ee76fbf1c21715887149d8"
},
{
"fixed": "ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2026.4.12"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2026.4.12-beta.1",
"v2026.4.11",
"v2026.4.11-beta.1",
"v2026.4.10",
"v2026.4.9",
"v2026.4.9-beta.1",
"v2026.4.8",
"v2026.4.7-1",
"v2026.4.7",
"v2026.4.5",
"v2026.4.2",
"v2026.4.1",
"v2026.4.1-beta.1",
"v2026.3.31",
"v2026.3.31-beta.1",
"v2026.3.28",
"v2026.3.28-beta.1",
"v2026.3.24",
"v2026.3.24-beta.2",
"v2026.3.24-beta.1",
"v2026.3.23-2",
"v2026.3.23",
"v2026.3.23-beta.1",
"v2026.3.22",
"v2026.3.22-beta.1",
"v2026.3.13-1",
"v2026.3.13",
"v2026.3.12",
"v2026.3.11",
"v2026.3.11-beta.1",
"v2026.3.8",
"v2026.3.8-beta.1",
"v2026.3.7",
"v2026.3.7-beta.1",
"v2026.3.2-beta.1",
"v2026.3.2",
"v2026.3.1",
"v2026.2.26",
"v2026.2.26-beta.1",
"v2026.2.25",
"v2026.2.25-beta.1",
"v2026.2.24",
"v2026.2.24-beta.1",
"v2026.2.23",
"v2026.2.23-beta.1",
"v2026.2.22",
"v2026.2.22-beta.1",
"v2026.2.21",
"v2026.2.21-beta.1",
"v2026.2.19-beta.1",
"v2026.2.19",
"v2026.2.17",
"v2026.2.15-beta.1",
"v2026.2.14",
"v2026.2.13",
"v2026.2.12",
"v2026.2.9",
"v2026.2.6-3",
"v2026.2.6-2",
"v2026.2.6-1",
"v2026.2.6",
"v2026.2.3",
"v2026.2.2",
"v2026.2.1",
"v2026.1.30",
"v2026.1.29",
"v2026.1.24-1",
"v2026.1.24",
"v2026.1.23",
"v2026.1.22",
"v2026.1.21",
"v2026.1.20",
"v2026.1.16-2",
"v2026.1.15",
"v2026.1.14-1",
"v2026.1.13",
"v2026.1.12-2",
"v2026.1.12",
"v2026.1.11-3",
"v2026.1.11-2",
"v2026.1.11-1",
"v2026.1.11",
"v2026.1.10",
"v2026.1.9",
"v2026.1.8",
"v2026.1.5-3",
"v2026.1.5-2",
"v2026.1.5-1",
"v2026.1.5",
"v2.0.0-beta5",
"v2.0.0-beta4",
"v2.0.0-beta3",
"v2.0.0-beta2",
"v2.0.0-beta1",
"v1.3.0",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.0",
"v1.0.4",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43526.json"
}
}
],
"modified": "2026-10-28T02:30:25.180341417Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43526.json",
"https://github.com/openclaw/openclaw/security/advisories/GHSA-2767-2q9v-9326",
"https://nvd.nist.gov/vuln/detail/CVE-2026-43526",
"https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-qqbot-reply-media-url-handling",
"https://github.com/openclaw/openclaw/commit/08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a",
"https://github.com/openclaw/openclaw/commit/ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d"
],
"provider_metadata": {
"cwe_ids": [
"CWE-918"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43526.json"
}
},
"related_cves": [
{
"value": "CVE-2026-43526",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491813,
"published_at": "2026-05-05T11:24:58.093+00:00"
}