N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vjx8-8p7h-82gr

GHSA-vjx8-8p7h-82gr: OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection

Summary

Marketplace Plugin Download Follows Redirects Without SSRF Protection

Current Maintainer Triage

Status: open
Normalized severity: medium
Assessment: v2026.3.28 still uses bare redirect-following fetch in src/plugins/marketplace.ts for marketplace archives, and fixed-on-main only does not change that shipped SSRF exposure.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

2ce44ca6a1302b166a128abbd78f72114f2f4f52 — 2026-03-31T12:59:42+01:00

Release Process Note

The fix is already present in released version 2026.3.31.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-vjx8-8p7h-82gr

GHSA-vjx8-8p7h-82gr:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the marketplace plugin download functionality of OpenClaw. The root cause is that the code responsible for downloading plugin archives from a URL followed HTTP redirects without validating the final redirected URL. This allowed an attacker to craft a URL that, when processed by the server, would redirect the request to an internal service, enabling the attacker to probe the internal network or access sensitive data.

The analysis of the patch 2ce44ca6a1302b166a128abbd78f72114f2f4f52 reveals that the function downloadUrlToTempFile in src/plugins/marketplace.ts was responsible for this download process. The original implementation was removed and replaced with a more robust version that now uses fetchWithSsrFGuard to get both the response and the finalUrl after redirects. The new code validates this finalUrl and implements other security measures like download size limits and timeouts.

Therefore, the primary vulnerable function is downloadUrlToTempFile. The function installPluginFromMarketplace is the entry point for this vulnerable workflow and would appear in a profiler's output during exploitation.

Vulnerable functions

downloadUrlToTempFile

src/plugins/marketplace.ts

This function was responsible for downloading a plugin from a URL. The original implementation used a `fetch` operation that followed HTTP redirects without validating the final URL. This allowed an attacker to provide a URL that redirects to an internal service, leading to a Server-Side Request Forgery (SSRF) vulnerability. The patch replaces this function with a new implementation that inspects the final URL after redirection and implements other security controls.

installPluginFromMarketplace

src/plugins/marketplace.ts

This is the main exported function for installing a plugin from the marketplace. It serves as the entry point for the vulnerable workflow. It calls internal functions that eventually lead to the vulnerable `downloadUrlToTempFile` function being called. An exploit would likely trigger this function, so it would appear in a runtime profile or stack trace.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.