PT-2026-27236 · Openclaw · Openclaw

Tdjackey · Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-32902

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description The software contains a server-side request forgery issue in the web search citation redirect resolution functionality. This allows attackers to target private network destinations. An attacker who can influence citation redirect targets can initiate requests to internal network locations from the OpenClaw gateway host.

Recommendations Update to version 2026.3.1 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-32902

Affected Products

Openclaw

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-32902 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-g99v-8hwm-g76g · Note
• https://twitter.com/TheHackerWire/status/2036208483075498281 · Twitter Post
• https://vulncheck.com/advisories/openclaw-mar-server-side-request-forgery-via-citation-redirect-resolution · Note
• https://twitter.com/VulmonFeeds/status/2036288368145748143 · Twitter Post