CVE-2026-41302

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.6

CVSS v4.0

4.8

EPSS

0.22%

Published

Apr 20, 2026

Modified

Apr 27, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch() calls to access internal resources or interact with external services on behalf of the affected system.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weaknesses (CWE)

CWE-918

Affected Products (1)

openclaw · openclaw (up to 2026.3.31)vulnerable

References (3)

https://github.com/openclaw/openclaw/commit/8deb9522f3d2680820588b190adb4a2a52f3670b

Patch

https://github.com/openclaw/openclaw/security/advisories/GHSA-9q7v-8mr7-g23p

Vendor Advisory

https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-fetch-in-marketplace-plugin-download

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs