Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resources by following unvalidated redirects. The marketplace.ts module fails to restrict redirect destinations during archive downloads, enabling remote attackers to redirect requests to arbitrary internal or external servers.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41297 OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access intern… https://www.cve.org/CVERecord?id=CVE-2026-41297
Post summary
OpenClaw prior to version 2026.3.31 contains a server‑side request forgery vulnerability in the marketplace plugin download feature, allowing attackers to access internal resources.
CVE-2026-41297 Server-Side Request Forgery in OpenClaw Marketplace Plugin Before 2026.3.31 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41297
Post summary
This brief post discloses a server‑side request forgery flaw in the OpenClaw Marketplace Plugin affecting versions prior to 2026.3.31, with a link to detailed CVE information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |