Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-62216OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload

Medium 5.0

In plain English

A medium-severity server-side request forgery in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (server-side request forgery). The practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw	2026.4.20 – before 2026.5.28

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-fwgr-fpv9-vf5x) vendor-advisory
VulnCheck Advisory: OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload third-party-advisory