OpenClaw affected by SSRF via unguarded image download in fal provider
## Summary The fal provider used raw fetches for both provider API traffic and returned image download URLs instead of the existing SSRF-guarded fetch path. ## Impact A malicious or compromised fal relay could make the gateway fetch internal URLs and expose metadata or internal service responses through the image pipeline. ## Affected Component `extensions/fal/image-generation-provider.ts` ## Fixed Versions - Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `80d1e8a11a` (`fal: guard image fetches`). OpenClaw thanks @AntAISecurityLab for reporting.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-34504US | — | — | ||
OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal UR… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/80d1e8a11a2ac118c7f7a70bba9c862b6141d928WEB
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.28WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qxgf-hmcj-3xw3WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-34504ADVISORY
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-image-download-in-fal-providerWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan