OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access …

Published:

20 april 2026 om 22:00:00

Alert date:

21 april 2026 om 07:08:02

Source:

nvd.nist.gov

Web Technologies

OpenClaw versions before 2026.3.31 contain a server-side request forgery (SSRF) vulnerability in the marketplace plugin download functionality. The vulnerability exists in the marketplace.ts module which fails to properly validate redirect destinations during archive downloads. This allows remote attackers to redirect requests to arbitrary internal or external servers, potentially accessing sensitive internal resources. The vulnerability enables attackers to exploit unvalidated redirects to perform unauthorized server-side requests.

Technical details

Mitigation steps:

Affected products:

OpenClaw