Executive brief
OpenClaw, a local assistant tool, contains a security flaw in how it handles web requests. When the software is redirected from one website to another, it may incorrectly resend sensitive information, such as login credentials or private data, to the new destination. This could allow an attacker to steal confidential information by tricking the application into visiting a malicious link.
Technical details
A request body replay vulnerability exists in OpenClaw's 'fetchWithSsrFGuard' component due to improper handling of cross-origin redirects. The vulnerability, classified as an Open Redirect (CWE-601), occurs when the application fails to strip sensitive request bodies or headers when following a redirect to a different origin. An attacker can exploit this by triggering a redirect to a malicious server, effectively exfiltrating sensitive data contained in the original request. The issue affects versions prior to 2026.3.31 and was fully addressed in version 2026.4.8. Exploitation requires user interaction to trigger the initial request that leads to the redirect.
Affected products
- OpenClaw OpenClaw < 2026.4.8
Timeline
- 2026-04-08: advisory: Vendor and third-party advisories published
- 2026-04-08: disclosed
- 2026-04-08: patched: Fixed in version 2026.4.8