What is the CVSS score of CVE-2026-32902?

CVE-2026-32902 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L.

Which versions of Openclaw are affected by CVE-2026-32902?

OpenClaw versions prior to 2026.3.1 contain an unauthenticated server-side request forgery (SSRF) vulnerability that allows remote attackers to redirect traffic through the OpenClaw gateway to access…. A patch is available.

How to fix or mitigate CVE-2026-32902?

Within 24 hours: Identify all OpenClaw instances in production and determine current versions. Within 7 days: Apply vendor patch to OpenClaw 2026.3.1 or later across all affected systems; validate patched versions in non-production first. Within 30 days: Conduct network traffic analysis for suspicious citation redirect requests and review access logs for any exploitation attempts.

Openclaw CVE-2026-32902

EUVD-2026-14582 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-23 VulnCheck

GHSA-m9v8-cr49-xcmg

SSRF Openclaw

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:18 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.1

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14582

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

CVE Published

Mar 23, 2026 - 21:36 nvd

HIGH 8.3

DescriptionCVE.org

OpenClaw before 2026.3.1 contains a server-side request forgery vulnerability in web_search citation redirect resolution that allows attackers to target private-network destinations. Attackers who influence citation redirect targets can trigger internal-network requests from the OpenClaw gateway host.

AnalysisAI

OpenClaw contains a server-side request forgery (SSRF) vulnerability in its web search citation redirect resolution mechanism that allows unauthenticated remote attackers to trigger requests to internal network destinations from the OpenClaw gateway host. OpenClaw versions prior to 2026.3.1 are affected. Attackers who can influence citation redirect targets can exploit this to access private network resources, with a CVSS score of 8.3 indicating high severity with low complexity and no privileges required.

Technical ContextAI

This vulnerability affects OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), which appears to be a web-based application with citation or search functionality. The issue is classified as CWE-918 (Server-Side Request Forgery), a vulnerability class where an application can be manipulated to make HTTP requests to arbitrary destinations chosen by the attacker. In this case, the flaw exists in the citation redirect resolution component of the web search functionality, where the application follows redirects without proper validation of the target destination. This allows attackers to abuse the server as a proxy to access internal network resources that would normally be unreachable from external networks, bypassing firewall protections and network segmentation.

RemediationAI

Upgrade OpenClaw to version 2026.3.1 or later, which addresses the SSRF vulnerability in citation redirect resolution (see GitHub advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-g99v-8hwm-g76g). As an interim mitigation before patching, implement network segmentation to restrict the OpenClaw gateway host's access to internal networks using firewall rules or security groups, limiting outbound connections to only necessary external destinations. Deploy a web application firewall (WAF) with rules to detect and block SSRF attempts by monitoring for suspicious redirect targets, private IP addresses (RFC 1918 ranges), localhost references, and cloud metadata endpoints. Review application logs for any suspicious citation redirect activity that may indicate reconnaissance or exploitation attempts.