CVE-2026-41914: OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41914?
CVE-2026-41914 is classified as a medium severity vulnerability due to its potential to enable unauthorized access to internal resources.
How do I fix CVE-2026-41914?
To fix CVE-2026-41914, you should update OpenClaw to version 2026.4.8 or later.
What types of attacks can exploit CVE-2026-41914?
CVE-2026-41914 can be exploited through server-side request forgery attacks targeting unprotected media fetch endpoints.
Which versions of OpenClaw are affected by CVE-2026-41914?
CVE-2026-41914 affects OpenClaw versions prior to 2026.4.8.
What are the consequences of exploiting CVE-2026-41914?
Exploitation of CVE-2026-41914 can lead to unauthorized access to sensitive internal resources, posing a risk to data confidentiality.