OpenClaw affected by SSRF via unguarded image download in fal provider
## Summary The fal provider used raw fetches for both provider API traffic and returned image download URLs instead of the existing SSRF-guarded fetch path. ## Impact A malicious or compromised fal relay could make the gateway fetch internal URLs and expose metadata or internal service responses through the image pipeline. ## Affected Component `extensions/fal/image-generation-provider.ts` ## Fixed Versions - Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `80d1e8a11a` (`fal: guard image fetches`). OpenClaw thanks @AntAISecurityLab for reporting.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-34504US | — | — | ||
OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal UR… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/80d1e8a11a2ac118c7f7a70bba9c862b6141d928WEB
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.28WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qxgf-hmcj-3xw3WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-34504ADVISORY
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-image-download-in-fal-providerWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan