CVE-2026-62216: OpenClaw policy bypass enables SSRF

CISO Take

OpenClaw, an AI agent framework, ships a QQBot media upload feature whose policy enforcement can be bypassed, letting a lower-trust caller or a configured input path make the agent's media upload reach network destinations that OpenClaw's egress policy was supposed to block — a classic server-side request forgery mediated by an AI agent tool. There is no evidence of active exploitation: it is absent from CISA KEV, has no published EPSS score, no public proof-of-concept, and no Nuclei scanner template, and the CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) reflects a confidentiality-only, medium-severity issue whose real blast radius depends entirely on the operator's network segmentation and whether untrusted input can reach the media upload path. The detail that matters most for risk sizing is the scope-changed vector (S:C): a policy-bypassed request from an agent tool can pivot into internal-only destinations — cloud metadata endpoints, internal APIs, admin panels — that were never meant to be reachable from agent-triggered traffic. Upgrade to OpenClaw 2026.5.28 or later; in the interim, audit the egress policy configuration around the QQBot media upload path and enforce network-level allowlisting or an egress proxy in front of agent hosts so an application-layer policy bypass cannot translate into unrestricted network access. Detection teams should monitor for outbound requests from OpenClaw hosts to unexpected internal IP ranges or the cloud metadata service (169.254.169.254) originating from the media upload feature.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 5.0) with low attack complexity and no user interaction required, but privileges required (PR:L) and a configuration-dependent trigger path limit ease of exploitation. No EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template indicate this is not currently being weaponized or scanned for at scale. The scope-changed, confidentiality-only impact (C:L/I:N/A:N) means the practical severity is driven almost entirely by the operator's deployment: if the agent's network path has access to sensitive internal services or cloud metadata, this SSRF becomes a meaningful reconnaissance and potentially credential-theft primitive; if the agent is deployed with strict network isolation, exploitability is largely theoretical. Overall risk: low-to-moderate today, contingent on network exposure — re-assess if a PoC or KEV addition appears.

How does the attack unfold?

Entry via agent tool

A lower-trust caller or a configured input path supplies a media reference to OpenClaw's QQBot media upload feature.

AML.T0053

Policy bypass / SSRF

The policy meant to block certain network destinations for the upload is bypassed, and the request is sent to an unintended internal or external destination.

Internal reconnaissance / data exposure

If the agent host can reach internal services or cloud metadata endpoints, the attacker uses the SSRF as a blind pivot to enumerate or exfiltrate reachable data.

AML.T0086

Entry via agent tool

A lower-trust caller or a configured input path supplies a media reference to OpenClaw's QQBot media upload feature.

AML.T0053

Policy bypass / SSRF

The policy meant to block certain network destinations for the upload is bypassed, and the request is sent to an unintended internal or external destination.

Internal reconnaissance / data exposure

If the agent host can reach internal services or cloud metadata endpoints, the attacker uses the SSRF as a blind pivot to enumerate or exfiltrate reachable data.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.0 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C Low

I None

A None

What should I do?

1 step

1) Patch OpenClaw to version 2026.5.28 or later, which fixes the policy bypass per the vendor advisory. 2) Until patched, audit and restrict the media upload feature's configured input path — verify no lower-trust caller (external user, untrusted webhook, third-party integration) can supply URLs or destinations to this feature. 3) Enforce network-level controls independent of application policy: place agent hosts behind an egress proxy/allowlist, block outbound access to link-local/metadata ranges (169.254.169.254, 169.254.170.2) and internal RFC1918 ranges unless explicitly required. 4) Detection: monitor agent host outbound connections for requests to internal IPs, metadata endpoints, or unexpected ports originating from the media upload code path; alert on any egress policy violations logged by OpenClaw itself. 5) Review CWE-918 (SSRF) guidance and confirm similar upload/fetch features elsewhere in the agent's tool surface enforce the same destination allowlisting.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62216?

OpenClaw, an AI agent framework, ships a QQBot media upload feature whose policy enforcement can be bypassed, letting a lower-trust caller or a configured input path make the agent's media upload reach network destinations that OpenClaw's egress policy was supposed to block — a classic server-side request forgery mediated by an AI agent tool. There is no evidence of active exploitation: it is absent from CISA KEV, has no published EPSS score, no public proof-of-concept, and no Nuclei scanner template, and the CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) reflects a confidentiality-only, medium-severity issue whose real blast radius depends entirely on the operator's network segmentation and whether untrusted input can reach the media upload path. The detail that matters most for risk sizing is the scope-changed vector (S:C): a policy-bypassed request from an agent tool can pivot into internal-only destinations — cloud metadata endpoints, internal APIs, admin panels — that were never meant to be reachable from agent-triggered traffic. Upgrade to OpenClaw 2026.5.28 or later; in the interim, audit the egress policy configuration around the QQBot media upload path and enforce network-level allowlisting or an egress proxy in front of agent hosts so an application-layer policy bypass cannot translate into unrestricted network access. Detection teams should monitor for outbound requests from OpenClaw hosts to unexpected internal IP ranges or the cloud metadata service (169.254.169.254) originating from the media upload feature.

Is CVE-2026-62216 actively exploited?

No confirmed active exploitation of CVE-2026-62216 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62216?

1) Patch OpenClaw to version 2026.5.28 or later, which fixes the policy bypass per the vendor advisory. 2) Until patched, audit and restrict the media upload feature's configured input path — verify no lower-trust caller (external user, untrusted webhook, third-party integration) can supply URLs or destinations to this feature. 3) Enforce network-level controls independent of application policy: place agent hosts behind an egress proxy/allowlist, block outbound access to link-local/metadata ranges (169.254.169.254, 169.254.170.2) and internal RFC1918 ranges unless explicitly required. 4) Detection: monitor agent host outbound connections for requests to internal IPs, metadata endpoints, or unexpected ports originating from the media upload code path; alert on any egress policy violations logged by OpenClaw itself. 5) Review CWE-918 (SSRF) guidance and confirm similar upload/fetch features elsewhere in the agent's tool surface enforce the same destination allowlisting.

What systems are affected by CVE-2026-62216?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool integrations.

What is the CVSS score for CVE-2026-62216?

CVE-2026-62216 has a CVSS v3.1 base score of 5.0 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool integrations

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (server-side request forgery). The practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Exploitation Scenario

An attacker with low-privilege access to the OpenClaw agent — for example, a user of a downstream chat integration, or an actor able to influence a configured input field consumed by the QQBot media upload feature — submits a crafted media reference (e.g., a URL or path) that should be blocked by OpenClaw's egress policy. Due to the policy bypass, the agent's media upload logic fetches or forwards the request to an unintended network destination instead of rejecting it. If the agent host can reach cloud metadata services or internal management APIs, the attacker uses this as a blind SSRF primitive to enumerate internal network topology, retrieve instance credentials from a metadata endpoint, or probe internal services for further attack staging — all without needing direct network access themselves, since the AI agent acts as the network intermediary.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.