UNKNOWNCVE-2026-34504
OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider
Platform
other
Component
openclaw
Fixed in
2026.3.28
OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded image download fetches to expose internal service metadata and responses through the image pipeline.
How to fix
Actualice OpenClaw a la versión 2026.3.28 o posterior. Esto corrige la vulnerabilidad de Server-Side Request Forgery (SSRF) en el proveedor fal, evitando que atacantes puedan acceder a URLs internas a través de la descarga de imágenes.
Monitor your dependencies automatically
Get notified when new vulnerabilities affect your projects. Free forever.
Start free