CVE-2026-44117: OpenClaw QQBot SSRF Vulnerability

CVE-2026-44117 Overview

CVE-2026-44117 is a server-side request forgery (SSRF) vulnerability in OpenClaw before version 2026.4.20. The flaw resides in the QQBot direct media upload functionality, where the application skips URL validation on user-supplied image references. Attackers can submit crafted URLs to the uploadC2CMedia and uploadGroupMedia endpoints to bypass SSRF protections and force the server to relay unintended requests. The weakness is classified under CWE-918 (Server-Side Request Forgery).

Critical Impact
Unauthenticated network attackers can coerce the OpenClaw server into issuing arbitrary outbound HTTP requests, enabling reconnaissance of internal services and abuse of the server as a request relay.

Affected Products

OpenClaw versions before 2026.4.20
OpenClaw QQBot uploadC2CMedia endpoint
OpenClaw QQBot uploadGroupMedia endpoint

Discovery Timeline

2026-05-06 - CVE-2026-44117 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-44117

Vulnerability Analysis

OpenClaw exposes QQBot media upload endpoints that accept remote image URLs and fetch the referenced content server-side before forwarding it to upstream messaging services. In versions prior to 2026.4.20, the direct media upload path bypasses the URL validation routine that the broader application enforces elsewhere. As a result, the server retrieves arbitrary URLs supplied through the uploadC2CMedia and uploadGroupMedia endpoints. Attackers can target internal hostnames, loopback interfaces, link-local metadata services, or non-HTTP schemes that the underlying fetch library accepts. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges, and no user interaction, with limited impact on subsequent system confidentiality.

Root Cause

The direct media upload code path in QQBot does not call the SSRF-protection validator that gates other URL-handling routines. Image URLs flow directly from the API request body into the HTTP fetch routine without host allowlisting, scheme restriction, or DNS resolution checks. The omission means that protections present in adjacent code paths are not applied uniformly.

Attack Vector

A remote attacker sends an HTTP request to the uploadC2CMedia or uploadGroupMedia endpoint with an image parameter pointing at an attacker-chosen URL. The OpenClaw server resolves the host and issues an outbound request from its own network position. Targets typically include internal HTTP services, cloud instance metadata endpoints, and administrative interfaces reachable only from the server. The server response or timing differences can be observed to map internal infrastructure.

No verified proof-of-concept code is published. Refer to the VulnCheck SSRF Advisory and the GitHub Security Advisory for vendor technical detail.

Detection Methods for CVE-2026-44117

Indicators of Compromise

Unexpected outbound HTTP requests originating from the OpenClaw host to internal RFC1918 ranges, 127.0.0.1, or 169.254.169.254.
Access log entries against uploadC2CMedia or uploadGroupMedia containing image URLs that reference non-public hostnames or unusual ports.
Spikes in failed DNS lookups or connection attempts from the OpenClaw process to non-standard destinations.

Detection Strategies

Inspect application access logs for POST requests to the QQBot media upload endpoints and parse the supplied image URL for private, loopback, or metadata destinations.
Correlate process-level network telemetry with web request logs to flag outbound connections initiated immediately after a media upload call.
Apply web application firewall rules that reject media upload requests whose URL parameters resolve to internal IP ranges.

Monitoring Recommendations

Forward OpenClaw web and process telemetry into a centralized analytics platform and alert on outbound connections from the OpenClaw service to internal subnets or cloud metadata addresses.
Track request volume to uploadC2CMedia and uploadGroupMedia and alert on anomalous spikes from individual source IPs.
Enable egress filtering logs at the network perimeter to capture blocked SSRF attempts for retrospective analysis.

How to Mitigate CVE-2026-44117

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.20 or later, which restores URL validation on the direct media upload path.
Restrict outbound network access from the OpenClaw host using egress firewall rules that block traffic to internal subnets and cloud metadata services.
Audit recent access logs for the uploadC2CMedia and uploadGroupMedia endpoints for suspicious URLs targeting internal hosts.

Patch Information

The maintainers fixed the issue in commit 49db424c8001f2f419aad85f434894d8d85c1a09, which reintroduces URL validation on the QQBot direct media upload code path. Review the GitHub Commit Update and apply the fix by updating to OpenClaw 2026.4.20 or later.

Workarounds

Place OpenClaw behind a forward proxy that enforces an allowlist of acceptable upstream image hosts.
Block requests to the uploadC2CMedia and uploadGroupMedia endpoints at the reverse proxy until the patch is deployed if the QQBot media feature is not required.
Apply host-based egress controls so the OpenClaw process cannot reach 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 169.254.169.254.

bash

# Example egress restriction using iptables on the OpenClaw host
iptables -A OUTPUT -m owner --uid-owner openclaw -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 169.254.169.254/32 -j REJECT