Openclaw CVE-2026-41297

Authentication is required (PR:L in CVSS vector) - the attacker must have a valid OpenClaw user account with marketplace plugin access permissions. User interaction is required (UI:P) - the attacker must either trick a user into initiating a plugin download or exploit an automated marketplace update mechanism. The marketplace plugin feature must be enabled and accessible in the target OpenClaw instance (non-default but commonly deployed feature). The vulnerability is triggered specifically during the archive download phase of the marketplace plugin workflow when HTTP redirects are encountered. Attack complexity is low (AC:L), meaning once authentication and user interaction are satisfied, exploitation is straightforward. Attack timing complexity (AT:P) suggests the attack window or timing may be constrained, possibly due to race conditions or time-sensitive operations in the marketplace module. Limitations: unauthenticated remote users cannot exploit this directly; internal firewall rules blocking outbound connections from the OpenClaw server to internal networks would prevent successful exploitation; and SSRF impact depends entirely on what internal services are reachable from the OpenClaw application server and whether those services accept requests without additional authentication.

The CVSS 4.8 (medium) score reflects several limiting factors: the attack requires prior authentication (PR:L), user interaction (UI:P), and contains attack timing complexity (AT:P). However, the CVSS vector indicates integrity impact (VI:L) and scope elevation (SC:H), suggesting the attacker can influence internal resource integrity or move laterally. EPSS and exploitation probability data are not provided, so real-world prevalence cannot be assessed. No CISA KEV listing is indicated, and no public exploit code is referenced in the provided data, suggesting this is not currently under active exploitation at scale. The risk assessment is nuanced: while the technical impact is moderate (integrity, not confidentiality of sensitive data), the requirement for authenticated access significantly reduces threat surface compared to unauthenticated SSRF vulnerabilities. However, in organizations where many users hold marketplace plugin access, the cumulative risk increases. Internal network architecture matters critically-if internal services lack network segmentation and accept requests from the OpenClaw application server, impact could escalate to data exfiltration or lateral movement. Defenders should assess whether OpenClaw instances have access to sensitive internal endpoints (e.g., Kubernetes API servers, cloud metadata, configuration management systems) to determine if this is a priority remediation.

An authenticated OpenClaw user with marketplace plugin access crafts a plugin download request. The attacker specifies a redirect URL pointing to an internal service, such as a cloud metadata endpoint (http://169.254.169.254/latest/meta-data/) or internal configuration API. When the OpenClaw server processes the download and encounters the HTTP 302 redirect response, it automatically follows the redirect without validating the destination hostname. The server then fetches the internal resource, and the attacker can either exfiltrate the response or use the SSRF to probe internal network topology. If user interaction (clicking a download link) is required, the attacker must socially engineer a legitimate user, but if the marketplace plugin has an automated update mechanism, exploitation could occur without direct user action.