PT-2026-33869

CVE-2026-41302

Published

2026-04-02

Updated

2026-04-21

Description by

CVSS 3.1

7.6

High

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A server-side request forgery (SSRF) issue exists in the marketplace plugin download functionality. This occurs due to unguarded fetch() calls, which allow remote attackers to make arbitrary network requests to access internal resources or interact with external services on behalf of the affected system.

Recommendations Update to version 2026.3.31 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tdjackey

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers