OpenClaw SSRF Vulnerability Exposes Internal Resources

The National Vulnerability Database (NVD) reports CVE-2026-41302, a high-severity (CVSS 7.6) server-side request forgery (SSRF) vulnerability in OpenClaw before version 2026.3.31. This flaw resides in the marketplace plugin download functionality, allowing remote attackers to initiate arbitrary network requests. Attackers can leverage unguarded fetch() calls to access internal network resources or interact with external services from the affected system’s perspective.

This isn’t just about data exfiltration; SSRF can lead to port scanning internal networks, bypassing firewalls, and interacting with services not directly exposed to the internet. The PR:L (low privileges required) and UI:R (user interaction required) vector components suggest an attacker with minimal access could still exploit this, potentially via a crafted link or malicious plugin, making it a significant risk for lateral movement and reconnaissance.

Defenders need to treat SSRF as a gateway to deeper compromise. The lack of specified affected products in the NVD entry means any organization using OpenClaw should assume they are vulnerable. Prioritize patching and scrutinize any internal network traffic originating from OpenClaw instances, especially related to plugin downloads or external integrations.