CVE-2026-44116
high
CVSS v3
8.6
CVSS v2
—
VIR risk
8.6
Description
OpenClaw validates Zalo outbound photo URLs through the SSRF guard
Predictions
Exploit likelihood
91%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: disclosure@vulncheck.com — https://github.com/openclaw/openclaw/security/advisories/GHSA-2hh7-c75g-qj2r
Vendor advisory: disclosure@vulncheck.com — https://github.com/openclaw/openclaw/commit/a65eb1b864b7630c1242a82de9e5799b80583c3f
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| openclaw | openclaw | {"endExcluding":"2026.4.22"} | 2026.4.22 |
References
- https://github.com/openclaw/openclaw/commit/a65eb1b864b7630c1242a82de9e5799b80583c3f
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2hh7-c75g-qj2r
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-zalo-photo-url-validation
- https://nvd.nist.gov/vuln/detail/CVE-2026-44116
- https://github.com/openclaw/openclaw
- https://github.com/advisories/GHSA-2hh7-c75g-qj2r
CWEs
CWE-918
Verify integrity in audit chain (admin only). AS-IS.