CVE-2026-43526: SSRF in OpenClaw QQBot Reply Media URLs

CVE-2026-43526 is a server side request forgery flaw (CVSS 8.2, high) in OpenClaw before version 2026.4.12. Media URLs in QQBot replies are fetched without enough checks, and the fetched bytes are then uploaded back through the channel. Upgrade to 2026.4.12 or later.

What's affected

The record says OpenClaw versions before 2026.4.12 are affected, which makes 2026.4.12 the first fixed version. The record links two fix commits and the project advisory GHSA-2767-2q9v-9326.

Only deployments using the QQBot channel handle these reply media URLs.

How to check if you're exposed

Find the version of OpenClaw you run and compare it with the fixed version above. If you installed it with npm, this works:

npm ls -g openclaw

Otherwise use the version your installer, container tag or deployment record shows. Then list the gateways, channels and webhooks that are exposed to people or systems you do not control, since these issues concern how untrusted input is handled.

What to do now

1. Upgrade OpenClaw to 2026.4.12 or later.
2. If you do not use QQBot, disable that channel.
3. Restrict outbound network access from the OpenClaw host so it cannot reach internal services or cloud metadata addresses.
4. Review logs for media fetches to internal or unusual addresses.
5. Record the version in your inventory.

Why it matters

The weakness is CWE-918, server side request forgery. A URL chosen by an outsider makes your server send a request. With the fetched bytes uploaded back through the channel, the content can travel back to the requester, which turns a blind request into a way to read data.

Services that sit on internal networks are the usual reward, as are cloud metadata endpoints. The KEV flag is false.

Quick check

Sources

• GitHub security advisory GHSA-2767-2q9v-9326 (listed in the NVD record, not retrieved)
• VulnCheck advisory (listed in the NVD record, not retrieved)
• Gold page for this CVE

Last reviewed: 19 October 2026.