PT-2026-31472 · Openclaw · Openclaw

Raax · CVE-2026-40037 · Published 2026-04-08 · Updated 2026-04-09

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description OpenClaw contains a request body replay vulnerability in the fetchWithSsrFGuard function that allows unsafe request bodies to be resent across cross-origin redirects. This could allow attackers to exfiltrate sensitive request data or headers to unintended origins.

Recommendations Update OpenClaw to version 2026.4.8 or later.

Exploit

Fix

Insufficient Verification of Data Authenticity

Open Redirect

Weakness Enumeration

CWE-345

CWE-601

Related Identifiers

CVE-2026-40037

GHSA-PG8G-F2HF-X82M

GHSA-QX8J-G322-QJ6M

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40037.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qx8j-g322-qj6m · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://osv.dev/vulnerability/GHSA-pg8g-f2hf-x82m · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qx8j-g322-qj6m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40037 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40037 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-unsafe-request-body-replay-via-fetchwithssrfguard-cross-origin-redirects · Note
• https://twitter.com/dailycve/status/2042311657754407331 · Twitter Post