{"action":"Upgrade openclaw to 2026.3.31 or later.","affected":[{"fixed":"2026.3.31","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41302"],"ecosystem":"npm","epss":0.00223,"exploited":false,"fixed_versions":["2026.3.31"],"ghsa_id":"GHSA-9q7v-8mr7-g23p","id":"tcs_01M5KFGM08RB24BTWND26QD7SZ","modified_at":"2026-05-05T16:08:04.062108Z","published_at":"2026-04-02T21:22:56Z","references":["https://osv.dev/vulnerability/GHSA-9q7v-8mr7-g23p","https://github.com/openclaw/openclaw/security/advisories/GHSA-9q7v-8mr7-g23p","https://nvd.nist.gov/vuln/detail/CVE-2026-41302","https://github.com/openclaw/openclaw/commit/8deb9522f3d2680820588b190adb4a2a52f3670b","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.3.31","https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-fetch-in-marketplace-plugin-download"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-9q7v-8mr7-g23p","url":"https://osv.dev/vulnerability/GHSA-9q7v-8mr7-g23p"}],"summary":"OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery"}