https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T23:56:01.291182+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-43526 BREW-openclaw-cli-CVE-2026-43526 — OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes 2026-09-28T23:56:01.292966+00:00

Affected: Homebrew: openclaw-cli

## Summary

QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.12` - Patched versions: `>= 2026.4.12`

## Impact

QQBot reply media URLs could be treated as trusted media sources, allowing SSRF fetches whose returned bytes were then re-uploaded through the channel.

## Technical Details

The fix routes QQBot remote media fetches through SSRF-guarded media fetching and explicit URL allowlist policy.

## Fix

The issue was fixed in #63495 and #65788. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a` - `ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d` - PR: #63495, #65788

## Release Process Note

Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @threalwinky for reporting this issue.

 https://db.gcve.eu/vuln/cve-2026-43526 CVE-2026-43526 — OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling 2026-09-28T23:56:01.293035+00:00

Affected: OpenClaw

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.