Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-44116

OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo Bot API, enabling unauthorized access to internal resources.

VectorNETWORK

PublishedMay 06, 2026, 20:16

Published Bydisclosure@vulncheck.com

Base Score

Score8.6

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

openclaw(npm)02026.4.22N/A

References

https://github.com/openclaw/openclaw/commit/a65eb1b864b7630c1242a82de9e5799b80583c3f
https://github.com/openclaw/openclaw/security/advisories/GHSA-2hh7-c75g-qj2r
https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-zalo-photo-url-validation

Weakness Type

CWE-918

CVSS Metrics

Base Score

6.9

Vector String

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityMedium

Version

4.0

Attack Vector (AV)

NETWORK