N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9q7v-8mr7-g23p

GHSA-9q7v-8mr7-g23p: OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery

Summary

SSRF via Unguarded fetch() in Marketplace Plugin Download and Ollama Model Discovery

Current Maintainer Triage

Status: narrow
Normalized severity: medium
Assessment: Keep the shipped marketplace archive-fetch SSRF, but narrow out the Ollama half because it is operator-configured and overlaps weaker trust-model or duplicate SSRF ground.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

8deb9522f3d2680820588b190adb4a2a52f3670b — 2026-03-30T20:08:38+01:00

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9q7v-8mr7-g23p

GHSA-9q7v-8mr7-g23p:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) present in the openclaw npm package. The analysis of the patch commit 8deb9522f3d2680820588b190adb4a2a52f3670b reveals that multiple functions across different files were making insecure fetch calls. These functions are related to two main features: Ollama model discovery and Marketplace plugin downloads.

In the Ollama integration files (extensions/ollama/src/provider-models.ts and extensions/ollama/src/setup.ts), functions like queryOllamaContextWindow, fetchOllamaModels, checkOllamaCloudAuth, and pullOllamaModelCore constructed request URLs from a base URL that could be configured by the operator. The code did not properly sanitize or restrict the hostnames for these outgoing requests, allowing a malicious operator to point the application to internal or arbitrary external URLs.

Similarly, in the marketplace functionality (src/plugins/marketplace.ts), the downloadUrlToTempFile function accepted a URL to download a plugin. This URL was not validated, creating an SSRF vulnerability where an attacker could provide a URL to an internal resource, causing the server to access it.

The patch addresses these issues by replacing all the vulnerable fetch calls with a new fetchWithSsrFGuard utility. This wrapper function enforces SSRF policies. For the Ollama-related functions, a specific policy is created using buildOllamaBaseUrlSsrFPolicy which pins the allowed hostname to the one configured for the Ollama service. For the marketplace download, fetchWithSsrFGuard is called with a specific audit context, implying a default or pre-configured policy is applied to prevent requests to unintended destinations.

Vulnerable functions

queryOllamaContextWindow

extensions/ollama/src/provider-models.ts

The function `queryOllamaContextWindow` was vulnerable to SSRF because it used the `fetch` API with a URL constructed from `apiBase`, which could be controlled by a user-configured value. This allowed an attacker to make the server send requests to arbitrary URLs. The patch replaced the direct `fetch` call with `fetchWithSsrFGuard` to restrict outgoing requests.

fetchOllamaModels

extensions/ollama/src/provider-models.ts

The function `fetchOllamaModels` was vulnerable to SSRF as it used an unguarded `fetch` call with a URL derived from a potentially user-controlled base URL (`apiBase`). This could be exploited to make the server issue requests to unintended internal or external services. The vulnerability was fixed by introducing `fetchWithSsrFGuard` which enforces an SSRF policy.

checkOllamaCloudAuth

extensions/ollama/src/setup.ts

The `checkOllamaCloudAuth` function was vulnerable to SSRF. It constructed a request URL using `apiBase` and made a request using `fetch` without proper validation. An attacker could manipulate the `apiBase` to force the server to make requests to arbitrary endpoints. The patch mitigates this by using the guarded `fetchWithSsrFGuard` function.

pullOllamaModelCore

extensions/ollama/src/setup.ts

The `pullOllamaModelCore` function was vulnerable to SSRF because it used a raw `fetch` call with a URL constructed from the `baseUrl` parameter. This could allow an attacker to specify a malicious URL, causing the server to initiate requests to arbitrary locations. The fix replaces the `fetch` call with `fetchWithSsrFGuard` to enforce hostname restrictions.

downloadUrlToTempFile

src/plugins/marketplace.ts

The `downloadUrlToTempFile` function was vulnerable to SSRF because it directly fetched a URL provided as an argument without any validation or restriction. This allowed an attacker to make the application download a file from any URL, including internal services. The patch remediated this by replacing the `fetch` call with `fetchWithSsrFGuard`, which provides a security layer against SSRF.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.