CVE-2026-41297

Katalog CVE

CVSS 7.6 · High EPSS 0,40%

Kerentanan Server-Side Request Forgery (SSRF) pada openclaw. Skor CVSS 3.1 7.6 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resources by following unvalidated redirects. The marketplace.ts module fails to restrict redirect destinations during archive downloads, enabling remote attackers to redirect requests to arbitrary internal or external servers.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.6 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-vjx8-8p7h-82gr advisory vendor
• https://github.com/openclaw/openclaw/commit/2ce44ca6a1302b166a128abbd78f72114f2f4f52 patch
• https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-marketplace-plugin-download-redi... advisory pihak ketiga