CVE-2026-41302: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41302 is a Server-Side Request Forgery (SSRF) vulnerability in OpenClaw's marketplace plugin download and Ollama model discovery functionality. It affects all OpenClaw (npm) versions up to and including 2026.3.28, and was patched in version 2026.3.31. The vulnerability was disclosed on April 20–21, 2026, with the fix committed on March 30, 2026. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, VulnCheck).

The root cause is CWE-918 (Server-Side Request Forgery): the marketplace plugin download and Ollama model discovery features used unguarded fetch() calls without validating or restricting the target URL, allowing attacker-controlled input to direct server-side HTTP requests to arbitrary destinations. The fix (commit 8deb952) introduced a fetchWithSsrFGuard() wrapper and a buildOllamaBaseUrlSsrFPolicy() function that enforces a hostname allowlist, pinning requests to the operator-configured Ollama hostname and blocking arbitrary targets. Exploitation requires low privileges and user interaction (e.g., triggering a plugin download or model discovery action), and is conducted over the network (GitHub Advisory, Patch Commit).

A remote attacker with low privileges can exploit this vulnerability to make the OpenClaw server issue arbitrary HTTP requests to internal network resources or external services, potentially exposing sensitive internal data (high confidentiality impact) and enabling limited unauthorized interactions with backend systems (low integrity impact). Availability is not directly affected. The SSRF could be leveraged to probe internal infrastructure, access cloud metadata endpoints, or pivot to services not otherwise reachable from the attacker's position (GitHub Advisory, VulnCheck).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate an internet-accessible OpenClaw instance running an npm version ≤ 2026.3.28 (e.g., via Shodan or Censys searches for OpenClaw service banners).
2. Authenticate with low privileges: Obtain or create a low-privileged user account on the OpenClaw instance, as the vulnerability requires authenticated access.
3. Trigger marketplace plugin download or Ollama model discovery: Navigate to the marketplace plugin download feature or Ollama model discovery UI, which internally invokes unguarded fetch() calls.
4. Inject a malicious URL: Supply or manipulate the URL parameter used by the marketplace or Ollama fetch functionality to point to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or an internal service address).
5. Retrieve response: The server fetches the attacker-specified URL and may return or process the response, allowing the attacker to read internal resource content or interact with internal services on behalf of the server (GitHub Advisory, Patch Commit).

• Network: Unexpected outbound HTTP/HTTPS requests from the OpenClaw server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (e.g., 169.254.169.254); outbound connections to unusual external hosts initiated by the OpenClaw process.
• Logs: Application or web server logs showing marketplace plugin download or Ollama model discovery requests with atypical or internal URLs as parameters; repeated failed or successful fetch attempts to non-marketplace hostnames.
• Process: The OpenClaw Node.js process initiating network connections to hosts outside the expected marketplace or Ollama service domains.

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which contains the fix introduced in commit 8deb9522f3d2680820588b190adb4a2a52f3670b (Patch Commit, GitHub Advisory). As a compensating control prior to patching, restrict outbound network access from OpenClaw servers using firewall rules to only allow connections to known-good external services, and implement network segmentation to limit the blast radius of potential SSRF exploitation. Monitor outbound traffic from OpenClaw instances for anomalous connection attempts.