CVE-2026-44116: OpenClaw Zalo Plugin SSRF Vulnerability

CVE-2026-44116 Overview

CVE-2026-44116 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in OpenClaw versions before 2026.4.22. The flaw resides in the Zalo plugin's sendPhoto function, which forwards outbound photo URLs to the Zalo Bot API without routing them through the SSRF guard. Attackers can supply a crafted photo URL pointing at internal infrastructure, causing the server to issue requests to resources that should not be reachable from the public internet. The vulnerability requires no authentication and is exploitable over the network.

Critical Impact
Unauthenticated attackers can coerce OpenClaw into making outbound HTTP requests to internal-only endpoints, exposing metadata services, internal APIs, and other restricted resources reachable from the host.

Affected Products

OpenClaw versions prior to 2026.4.22
OpenClaw Zalo plugin (extensions/zalo)
Deployments invoking the sendPhoto Zalo Bot API path

Discovery Timeline

2026-05-06 - CVE-2026-44116 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-44116

Vulnerability Analysis

The Zalo plugin in OpenClaw exposes a sendPhoto function that accepts a photo URL and relays it to the Zalo Bot API at https://bot-api.zaloplatforms.com. Prior to 2026.4.22, this code path did not invoke the platform's SSRF guard, so URLs supplied by callers were treated as trusted. An attacker who can reach the Zalo plugin can submit a URL referencing an internal IP, loopback interface, or cloud metadata endpoint. The OpenClaw server then performs the outbound fetch on behalf of the attacker, and depending on plugin behavior, the response or its side effects may be observable.

Root Cause

The root cause is missing URL validation in the Zalo plugin's outbound media path. The plugin lacked an SSRF policy enforcement layer for photo URLs, so DNS resolution and network egress were not constrained to public, allow-listed destinations. Internal address ranges (RFC1918, link-local, loopback, and cloud metadata IPs such as 169.254.169.254) were not filtered before the fetch was issued.

Attack Vector

Exploitation occurs over the network with low complexity and no privileges. An attacker invokes the Zalo plugin's photo-sending workflow with a malicious URL. The OpenClaw process resolves and connects to the supplied host, allowing the attacker to probe internal services, enumerate cloud metadata endpoints, or pivot toward internal HTTP-based APIs reachable from the OpenClaw host.

typescript

// Patch from extensions/zalo/src/api.ts
// fix(zalo): add SSRF guard on outbound photo URLs

import { resolvePinnedHostnameWithPolicy, type SsrFPolicy } from "openclaw/plugin-sdk/ssrf-runtime";

const ZALO_API_BASE = "https://bot-api.zaloplatforms.com";
const ZALO_MEDIA_SSRF_POLICY: SsrFPolicy = {};

export type ZaloFetch = (input: string, init?: RequestInit) => Promise<Response>;

Source: GitHub Commit a65eb1b. The patch introduces resolvePinnedHostnameWithPolicy and a ZALO_MEDIA_SSRF_POLICY so outbound media URLs are validated against an SSRF policy before any network request is issued.

Detection Methods for CVE-2026-44116

Indicators of Compromise

Outbound HTTP requests from the OpenClaw process targeting RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254.
Zalo plugin invocations of sendPhoto containing photo URLs whose hostnames resolve to internal IPs.
Anomalous DNS queries from the OpenClaw host for hostnames that subsequently resolve to private addresses.

Detection Strategies

Inspect application logs for sendPhoto calls and correlate the supplied URL hostname against an internal-IP allow list.
Enable egress proxy logging in front of the OpenClaw host and alert on connections to non-public destinations originating from the plugin runtime.
Hunt for response sizes and status codes consistent with cloud metadata services (for example, AWS IMDS responses) returned to the OpenClaw process.

Monitoring Recommendations

Forward OpenClaw and Zalo plugin telemetry to a centralized analytics platform and baseline outbound destinations from the plugin worker.
Monitor for spikes in sendPhoto invocations from a single tenant or API key, which can indicate enumeration attempts.
Track DNS resolutions performed by the OpenClaw process and alert when public hostnames resolve to private address space (DNS rebinding signal).

How to Mitigate CVE-2026-44116

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.22 or later, which includes the SSRF guard on the Zalo plugin's outbound photo URLs.
If upgrading is not immediately possible, disable the Zalo plugin or restrict access to the sendPhoto endpoint at the application gateway.
Audit historical logs for sendPhoto requests targeting internal address ranges and rotate any credentials that may have been reachable via the plugin.

Patch Information

The fix is delivered in commit a65eb1b864b7630c1242a82de9e5799b80583c3f and tracked in GHSA-2hh7-c75g-qj2r. The patch imports resolvePinnedHostnameWithPolicy from openclaw/plugin-sdk/ssrf-runtime and applies a ZALO_MEDIA_SSRF_POLICY to outbound media fetches in extensions/zalo/src/api.ts. Additional hardening in extensions/zalo/src/monitor.webhook.ts introduces explicit webhookUrl, webhookPath, and canHostMedia configuration fields. See the VulnCheck SSRF Advisory for OpenClaw for additional context.

Workarounds

Place the OpenClaw host behind an egress proxy that denies traffic to RFC1918, loopback, link-local, and cloud metadata addresses.
Configure host-level firewall rules to block the OpenClaw process from initiating connections to internal subnets unless explicitly required.
Apply IMDSv2 (or equivalent metadata service hardening) on cloud instances running OpenClaw to reduce the impact of metadata-targeted SSRF.

bash

# Example egress restriction using iptables on the OpenClaw host
iptables -A OUTPUT -m owner --uid-owner openclaw -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 127.0.0.0/8 -j REJECT