Openclaw CVE-2026-41302

The vulnerability requires the following specific conditions: (1) the attacker must possess valid OpenClaw user credentials (authentication required per PR:L); (2) the user must actively interact with the marketplace plugin download functionality (UI:P indicates user interaction is mandatory-the exploit cannot be triggered via network requests alone); (3) the marketplace plugin must be enabled and accessible within the OpenClaw deployment; (4) the application runtime context must have network access to the target internal service (SSRF impact is limited to services reachable from the OpenClaw process). The CVSS attack time pressure (AT:P) suggests an additional temporal constraint, likely that the marketplace download must occur during a specific time window or the attacker's crafted URL must be pre-positioned before the user interaction. Notably, unauthenticated remote exploitation is NOT possible-an attacker cannot trigger this vulnerability without first compromising or obtaining valid OpenClaw credentials. The user interaction requirement prevents fully autonomous exploitation via malicious network traffic alone.

The CVSS 4.8 score indicates moderate severity, but the attack vector combination reveals limited real-world exploitability: the vulnerability requires an authenticated user (PR:L), explicit user interaction (UI:P), and attack time pressure (AT:P), substantially reducing autonomous exploit probability. The CVSS vector shows integrity impact only (VI:L) with no confidentiality or availability impact recorded, contradicting typical SSRF risk where internal resource access often leads to data disclosure or remote code execution via interaction with internal services. EPSS exploitation probability data is not provided, preventing calibration against baseline vulnerability populations. No CISA KEV listing or public proof-of-concept code has been identified, suggesting this is not actively exploited in the wild or weaponized. The authentication and user interaction requirements are significant limiting factors: an attacker cannot exploit this remotely without a valid OpenClaw account and user action. However, the combination of SSRF with internal network access potential and the presence of a security advisory indicates this is a legitimate priority for organizations running OpenClaw with trusted-user threat models. The real-world risk depends heavily on what internal services are accessible from the OpenClaw application context and whether users can be socially engineered to trigger downloads.

An authenticated OpenClaw user receives a social engineering message encouraging them to download a seemingly legitimate plugin update from the marketplace. The attacker has crafted a malicious marketplace entry or manipulated the plugin download URL to point to an internal service (e.g., http://169.254.169.254/latest/meta-data for AWS metadata or http://10.0.1.50:6379 for an internal Redis instance). When the user clicks the download button, the OpenClaw server makes an outbound request to the attacker's specified URL, exposing sensitive internal data (cloud credentials, API keys, cache contents) back to the attacker's monitoring system.