CVE-2026-41914 — OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection

Matched remediation archetype

Server-side request forgery and unintended proxying

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Inventory server-side URL fetchers, webhooks, importers, previews, redirects, proxies, and protocol handlers reachable from untrusted input.
• Map egress paths to internal services, metadata endpoints, loopback, private address space, and privileged control planes.
• Review DNS resolution, redirect, proxy, credential-forwarding, and URL parsing behavior without requesting sensitive targets.

Remediate safely

• Replace arbitrary destinations with named integrations or a strict allowlist of schemes, hosts, ports, and paths.
• Resolve and validate every destination and redirect hop, then enforce egress policy independently of application checks.
• Remove ambient credentials and sensitive headers from fetchers; apply response size, time, and content limits.