Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41914 Server-Side Request Forgery in OpenClaw Before 2026.4.8 QQ Bot Media Download https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41914
Post summary
The text announces a Server-Side Request Forgery (SSRF) vulnerability in OpenClaw prior to version 2026.4.8, providing its type but lacking details on exploitation or fixes.
CVE-2026-41914 OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprot… https://www.cve.org/CVERecord?id=CVE-2026-41914
Post summary
The post identifies a server‑side request forgery vulnerable in OpenClaw’s QQ Bot media download paths (CVE‑2026‑41914) and notes its potential exploitation, but does not provide a PoC, exploit code, patch, or evidence of active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |