Server-Side Request Forgery in OpenClaw Marketplace Plugin
CVE-2026-41297

4.8MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
20 April 2026

What is CVE-2026-41297?

OpenClaw's marketplace plugin prior to version 2026.3.31 is susceptible to a server-side request forgery attack. This vulnerability arises from the improper validation of redirect destinations in the plugin's download functionality. By exploiting this flaw, attackers can manipulate archive downloads to redirect requests to unauthorized internal or external servers, potentially exposing sensitive internal resources.

Affected Version(s)

OpenClaw 0 < 2026.3.31

OpenClaw 2026.3.31

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/2ce44ca6a1302...
patch
https://www.vulncheck.com/advisories/openclaw-server-side...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AntAISecurityLab
.