CVE-2026-41302— OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download
Quick assessment
Affected
OpenClaw OpenClaw
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.3.31之前版本存在代码问题漏洞，该漏洞源于市场插件下载功能存在服务端请求伪造，可能导致远程攻击者通过利用未受保护的fetch()调用来代表受影响系统进行任意网络请求。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41302
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download
Source: CVE Program / CVE List V5
Vulnerability Description
OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch() calls to access internal resources or interact with external services on behalf of the affected system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
OpenClaw 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.3.31之前版本存在代码问题漏洞，该漏洞源于市场插件下载功能存在服务端请求伪造，可能导致远程攻击者通过利用未受保护的fetch()调用来代表受影响系统进行任意网络请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-41302
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41302
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-41302 (1)
Same Patch Batch · OpenClaw · 2026-04-20 · 15 CVEs total
| CVE-2026-41329 | 9.9 CRITICAL | OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner |
| CVE-2026-41303 | 8.8 HIGH | OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands |
| CVE-2026-41294 | 8.6 HIGH | OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File |
| CVE-2026-41296 | 8.2 HIGH | OpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFile |
| CVE-2026-41295 | 7.8 HIGH | OpenClaw < 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Ch |
| CVE-2026-41297 | 7.6 HIGH | OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirec |
| CVE-2026-41299 | 7.1 HIGH | OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard |
| CVE-2026-41300 | 6.5 MEDIUM | OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding |
| CVE-2026-41389 | 5.8 MEDIUM | OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Path |
| CVE-2026-40045 | 5.7 MEDIUM | OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway |
| CVE-2026-41298 | 5.4 MEDIUM | OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint |
| CVE-2026-41301 | 5.3 MEDIUM | OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Veri |
| CVE-2026-41331 | 5.3 MEDIUM | OpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Tran |
| CVE-2026-41330 | 4.4 MEDIUM | OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy |
IV. Related Vulnerabilities
Same product: OpenClaw
-
CVE-2026-102806
OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media -
CVE-2026-102807
OpenClaw before 2026.9.4 Authorization Bypass via MCP App St -
CVE-2026-100599
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via -
CVE-2026-100598
OpenClaw before 2026.7.1 Approval Binding Logic Error -
CVE-2026-100597
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
Same vendor: OpenClaw
-
CVE-2026-101884
OpenClaw Windows Node before 2026.7.1 Remote Code Execution -
CVE-2026-101883
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.prese -
CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 Remote Code Execution -
CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 Denial of Service -
CVE-2026-101880
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
Same weakness: CWE-918
-
CVE-2026-82044
UTMStack < 11.2.16 Server-Side Request Forgery via downloadP -
CVE-2026-82040
UTMStack < 11.2.16 SSRF via IdentityProviderService -
CVE-2026-103958
Server-side request forgery in the tool server and remote ag -
CVE-2026-103957
Server-side request forgery in the OAuth2 discovery handling -
CVE-2020-37278
Weaver e-Bridge Unauthenticated Arbitrary File Read via save
V. Comments for CVE-2026-41302
No comments yet