A server-side request forgery vulnerability in OpenClaw before version 2026.4.12 allows unauthenticated attackers to fetch arbitrary content and potentially compromise internal network resources.

This is a server-side request forgery flaw, categorized under CWE-918, where unauthenticated attackers supply malicious media URLs via QQBot reply handling to trigger arbitrary outbound requests.

A successful exploit could allow malicious actors to interact with internal network services that are normally shielded from external access, leading to unauthorized data exposure or internal service manipulation. Given the CVSS score of 8.2, this high-severity flaw poses a significant risk to organizational perimeter security and internal infrastructure confidentiality.

Immediate Action: Update OpenClaw to version 2026.4.12 or later by applying the vendor security update.

Proactive Monitoring: Monitor outbound network traffic from the hosting server for anomalous connection attempts targeting internal IP ranges or restricted services.

Compensating Controls: Implement egress filtering and strict firewall rules on the hosting server to restrict outbound requests only to authorized external endpoints.

Public Exploit Available: No (false / unknown)

Security teams must prioritize patching OpenClaw to version 2026.4.12 to eliminate the underlying server-side request forgery vulnerability. Immediate application of the update is critical for maintaining perimeter defenses and preventing potential internal network reconnaissance.