PT-2026-33864 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-07 · Updated 2026-04-21 · CVE-2026-41297

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A server-side request forgery (SSRF) issue exists in the marketplace plugin download functionality. The marketplace.ts module fails to restrict redirect destinations during archive downloads, allowing remote attackers to access internal resources or redirect requests to arbitrary internal or external servers by following unvalidated redirects.

Recommendations Update to version 2026.3.31 or later. As a temporary workaround, restrict access to the marketplace.ts module to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41297

GHSA-VJX8-8P7H-82GR

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/2ce44ca6a1302b166a128abbd78f72114f2f4f52 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vjx8-8p7h-82gr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vjx8-8p7h-82gr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41297 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-server-side-request-forgery-via-marketplace-plugin-download-redirect · Note
• https://twitter.com/CVEnew/status/2046571882732994933 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046461778448580945 · Twitter Post