CVE-2026-34504: SSRF in OpenClaw Image Generation Provider

The primary impact of this SSRF vulnerability lies in the potential for unauthorized access to internal resources. A malicious or compromised fal relay, exploiting this flaw, can initiate requests to internal URLs that would normally be inaccessible from the outside. This could lead to the exposure of sensitive metadata, internal service responses, or other confidential information. The blast radius is limited to the internal network accessible by the fal relay, but the consequences of data exposure could be significant, particularly if the exposed information relates to authentication credentials or sensitive business data. While not directly exploitable for remote code execution, the SSRF could be a stepping stone for further attacks if internal services are vulnerable.

1. Reserved2026-03-30
2. Published2026-04-01
3. Modified2026-04-06
4. EPSS updated2026-04-08

The recommended mitigation for CVE-2026-34504 is to immediately upgrade OpenClaw to version 2026.3.28 or later. This version includes the fix implemented in commit 80d1e8a11a, which properly guards image fetches against SSRF attacks. If upgrading is not immediately feasible, consider implementing stricter network segmentation to limit the fal relay's access to internal resources. Additionally, review and restrict the permissions granted to the fal relay to minimize the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting to access internal URLs through the image generation pipeline and verifying that access is denied.