CVE-2026-41302 MEDIUM

CVE-2026-41302: OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download

Vendor Openclaw

Product OpenClaw

Weakness CWE-918 · SSRF

Published April 20, 2026

Last update April 21, 2026

View on NVD All CVEs

CVSS base score

4.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch() calls to access internal resources or interact with external services on behalf of the affected system.

Key dates

02Disclosure timeline

April 20, 2026 CVE published

April 21, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-41302 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html

Related vulnerabilities

04Related CVE

CVE-2025-5817 Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery CVE-2026-25904 Overly permissive Deno configuration in mcp-run-python leads to SSRF CVE-2024-6095 SSRF and Partial LFI in /models/apply Endpoint in mudler/localai CVE-2026-43879 WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass CVE-2024-12450 RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow