Executive brief
OpenClaw is a popular open-source marketplace plugin manager that allows users to download and install extensions. The vulnerability allows attackers to perform server-side request forgery (SSRF) attacks by crafting malicious HTTP redirects during marketplace plugin downloads, potentially enabling access to internal network resources, metadata services, or other sensitive endpoints that should not be directly accessible from the internet.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in the marketplace plugin download functionality. The vulnerable code in src/plugins/marketplace.ts uses a bare HTTP fetch without SSRF protection that blindly follows redirects when downloading marketplace archives. An attacker can host a malicious marketplace plugin or intercept the download process to redirect requests to internal IP addresses, localhost services, or cloud metadata endpoints. The attack requires an authenticated user with permission to initiate plugin downloads and some form of user interaction to trigger the download. The vulnerability has been patched in version 2026.3.31 and later.
Affected products
- OpenClaw openclaw <=2026.3.28
Timeline
- 2026-03-31: disclosed: Fix commit 2ce44ca6a1302b166a128abbd78f72114f2f4f52
- 2026-03-31: patched: Version 2026.3.31 released with fix
- 2026-04-07: advisory: Advisory GHSA-vjx8-8p7h-82gr published