N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3fv3-6p2v-gxwj

GHSA-3fv3-6p2v-gxwj: OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

Impact

QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths.

QQ Bot media download paths were not consistently routed through the SSRF guard and allowlist policy.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.2
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @adithyan-ak for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-3fv3-6p2v-gxwj

GHSA-3fv3-6p2v-gxwj:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.8	2026.4.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security advisory points to a Server-Side Request Forgery (SSRF) vulnerability in the OpenClaw QQ Bot Extension, where media download paths were not consistently protected. The provided fix commit, d7c3210cd6f5fdfdc1beff4c9541673e814354d5, modifies the central SSRF protection function, fetchWithSsrFGuard, located in src/infra/net/fetch-guard.ts.

The analysis of the patch reveals a subtle logic flaw. The function was previously performing a DNS pinning operation (resolvePinnedHostnameWithPolicy) unconditionally. The commit message "fix(net): skip DNS pinning before trusted env proxy dispatch" and the addition of a new test case, "falls back to DNS pinning in trusted proxy mode when no proxy env var is configured", indicate that this unconditional operation was problematic.

The vulnerability occurs because this initial, unconditional DNS lookup could fail. The advisory's description that paths were "not consistently routed through the SSRF guard" suggests that the calling code (the QQ Bot extension) would react to this failure by making a separate, unguarded request, thus creating the SSRF vulnerability.

The patch corrects this by making the DNS pinning operation conditional. It is now skipped if a trusted environment proxy is configured, preventing the function from failing unnecessarily and forcing the caller to stay within the protected fetch workflow. Therefore, fetchWithSsrFGuard is the key function that, due to its flawed implementation, could lead to an insecure state and would appear in any runtime profile of the exploit.

Vulnerable functions

fetchWithSsrFGuard

src/infra/net/fetch-guard.ts

The vulnerability lies in the `fetchWithSsrFGuard` function, which is responsible for making secure, SSRF-protected HTTP requests. Before the patch, the function unconditionally performed a DNS lookup and IP address validation (`resolvePinnedHostnameWithPolicy`) at the beginning, even if the request was intended to be dispatched through a trusted environment proxy. This unconditional lookup could fail for various reasons. The advisory implies that some callers, specifically the QQ Bot media fetching paths, would handle this failure by falling back to an insecure, unguarded request method, thus bypassing the SSRF protection and leading to a vulnerability. The patch moves the call to `resolvePinnedHostnameWithPolicy` so that it is only executed when DNS pinning is actually required, and not when a trusted proxy is used. This prevents the function from throwing an unnecessary error in the proxy case, thereby preventing the insecure fallback behavior in the calling code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.