OpenClaw versions prior to 2026.8.1 do not validate URLs for video assets supplied by third‑party providers, enabling an attacker to publish URLs that point to private or loopback destinations; the OpenClaw CLI will then make server‑side requests to those addresses, potentially leaking internal information, accessing restricted services, or facilitating other attacks on the host system.

The vulnerability affects all instances of the OpenClaw application with a release earlier than 2026.8.1; users of older releases using external providers for video assets are at risk.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is currently unavailable, suggesting no publicly reported exploits; however the vulnerability is listed as not in the CISA KEV catalog. The likely attack vector involves a malicious or compromised provider that supplies a URL pointing to internal resources, so the risk depends on an attacker’s ability to control or compromise content providers and the exposure of internal services to the OpenClaw host.