OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to …

OpenClaw versions prior to 2026.3.31 contain a server-side request forgery (SSRF) vulnerability in the marketplace plugin download functionality. The vulnerability stems from unguarded fetch() calls that allow remote attackers to make arbitrary network requests. Attackers can exploit this flaw to access internal resources or interact with external services on behalf of the affected system. The vulnerability is present in the marketplace plugin download feature and poses a high security risk.