CVE-2026-40037: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-40037 is a request body replay vulnerability in OpenClaw's fetchWithSsrFGuard function that allows unsafe request bodies and headers to be resent across cross-origin redirects. It affects OpenClaw (npm package) versions before 2026.3.31, with a patch available in version 2026.4.8. The vulnerability was disclosed on April 8, 2026, and is scoped to OpenClaw's user-controlled local assistant trust model rather than a multi-tenant service boundary. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect), where the fetchWithSsrFGuard function in OpenClaw's network fetch guard (src/infra/net/fetch-guard.ts) fails to strip or block unsafe request bodies and sensitive headers when following cross-origin redirects. An attacker can exploit this by crafting or triggering a redirect from a legitimate origin to an attacker-controlled cross-origin destination, causing the guarded fetch to replay the original request body and headers — including potentially sensitive values like Authorization — to the unintended target. The fix, applied in commit d7c3210, also addressed a related DNS pinning bypass in trusted proxy mode and added targeted regression tests for the affected security boundary (Github Advisory, Patch Commit).

Successful exploitation results in a high confidentiality impact: sensitive request data — including HTTP request bodies and headers such as Authorization tokens — can be exfiltrated to attacker-controlled cross-origin destinations. There is no integrity or availability impact. Because OpenClaw is a user-controlled local assistant rather than a multi-tenant service, the blast radius is limited to the individual user's session data and credentials transmitted through the affected fetch function (Github Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.03%, reflecting a very low probability of exploitation in the near term. Exploitation requires user interaction (passive), meaning a victim must perform an action that triggers the vulnerable fetch with a cross-origin redirect (Feedly).

1. Identify a target: Locate a user running OpenClaw (npm) versions before 2026.3.31 that makes authenticated or sensitive HTTP requests through the fetchWithSsrFGuard function.
2. Set up a redirect: Control or compromise an intermediate server that the OpenClaw instance is expected to contact, configuring it to issue an HTTP redirect (e.g., 301/302) to an attacker-controlled cross-origin URL.
3. Trigger the fetch: Induce the victim user to perform an action within OpenClaw that causes fetchWithSsrFGuard to send a request (with a body or sensitive headers such as Authorization) to the intermediate server.
4. Capture replayed data: The vulnerable fetchWithSsrFGuard function follows the cross-origin redirect without stripping the request body or sensitive headers, resending them to the attacker-controlled origin, where they can be logged and exfiltrated (Github Advisory).

• Network: Unexpected outbound HTTP requests from the OpenClaw process to unfamiliar or attacker-controlled cross-origin domains, particularly following a redirect chain originating from a known legitimate endpoint.
• Network: HTTP POST or other non-GET requests observed being sent to cross-origin destinations that were not the original intended target, potentially carrying Authorization or other sensitive headers.
• Logs: Application or proxy logs showing redirect chains (HTTP 301/302) from trusted origins to external or unexpected cross-origin URLs, followed by a subsequent request to the redirect destination with a non-empty body.
• Logs: Anomalous access patterns in server logs at the redirect destination, showing receipt of request bodies or Authorization headers that should only have been sent to the original origin.

Upgrade the OpenClaw npm package to version 2026.4.8 or later, which contains the fix applied in commit d7c3210. Versions prior to 2026.3.31 are confirmed vulnerable. As an interim measure, organizations can implement network-level controls to monitor and restrict unexpected cross-origin redirect behavior from OpenClaw instances, and review access logs for evidence of sensitive data being sent to unintended origins (Github Advisory, Patch Commit).

The vulnerability was reported by researcher @BG0ECV and published by maintainer @steipete on April 8, 2026. The original GitHub advisory (GHSA-qx8j-g322-qj6m) was supplemented by a duplicate advisory (GHSA-pg8g-f2hf-x82m) that was subsequently withdrawn on April 10, 2026, with a note preserving external references. No significant broader media coverage or notable community commentary beyond the advisory publication has been identified (Github Advisory, Feedly).