Server-Side Request Forgery Vulnerability in OpenClaw's QQBot Media Upload

CVE-2026-44117

What is CVE-2026-44117?

OpenClaw versions prior to 2026.4.20 are susceptible to a server-side request forgery (SSRF) vulnerability specifically in the QQBot direct media upload feature. This issue arises as the application fails to validate URLs properly when handling crafted image upload requests to the uploadC2CMedia and uploadGroupMedia endpoints. Malicious users can exploit this flaw to send specially tailored URLs, effectively bypassing existing SSRF protections, leading to potential unauthorized access and unintended requests being relayed within the server environment.

References