CVE-2026-41914
HIGH
NVD
CVSS Score
8.5
Severity
HIGH
Published
Apr 28, 2026
Vendor
unknown
Description
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.