GitHub Advisoryadvisory · npm
GHSA-qxgf-hmcj-3xw3 OpenClaw affected by SSRF via unguarded image download in fal provider
LOW
Official page ↗
- Aliases
- CVE-2026-34504
- Ecosystem
- npm
- Packages
- openclaw
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L
- Weaknesses
- CWE-918
- Reviewed
- 2026-04-01
Affected packages
• npm openclaw: < 2026.3.28 → fixed in 2026.3.28
Description
Summary
The fal provider used raw fetches for both provider API traffic and returned image download URLs instead of the existing SSRF-guarded fetch path.
Impact
A malicious or compromised fal relay could make the gateway fetch internal URLs and expose metadata or internal service responses through the image pipeline.
Affected Component
`extensions/fal/image-generation-provider.ts`
Fixed Versions
• Affected: `= 2026.3.28`
• Latest stable `2026.3.28` contains the fix.
Fix
Fixed by commit `80d1e8a11a` (`fal: guard image fetches`).
OpenClaw thanks @AntAISecurityLab for reporting.
Related
Alias · CVE (1)
- CVE-2026-34504 OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component… vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qxgf-hmcj-3xw3 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-34504 advisory
- https://github.com/openclaw/openclaw/commit/80d1e8a11a2ac118c7f7a70bba9c862b6141d928 web
- https://github.com/openclaw/openclaw package
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 web
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-image-download-in-fal-provider web