CVE-2026-62216: OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload
OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (server-side request forgery). The practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.5.28 - Compensating control
Restrict lower-trust callers/input paths so they cannot reach the OpenClaw QQBot media upload feature path that can trigger policy bypass (SSRF).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62216?
The severity of CVE-2026-62216 is classified as low with a score of 2.3.
What does CVE-2026-62216 exploit?
CVE-2026-62216 exploits a policy bypass vulnerability in the QQBot media upload feature of OpenClaw.
How do I fix CVE-2026-62216?
To fix CVE-2026-62216, update OpenClaw to version 2026.5.28 or later.
What is the impact of CVE-2026-62216?
The impact of CVE-2026-62216 includes the potential for server-side request forgery due to media uploads reaching blocked network destinations.
Which versions of OpenClaw are affected by CVE-2026-62216?
OpenClaw versions prior to 2026.5.28 are affected by CVE-2026-62216.