Vulnerability Description
OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch() calls to access internal resources or interact with external services on behalf of the affected system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.31 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/8deb9522f3d2680820588b190adb4a2a52f3Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-9q7v-8mr7-g23pVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unThird Party Advisory
FAQ
What is CVE-2026-41302?
CVE-2026-41302 is a vulnerability with a CVSS score of 7.6 (HIGH). OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attacke...
How severe is CVE-2026-41302?
CVE-2026-41302 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41302?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.