OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-or...
Date: 2026-04
Affected: openclaw/openclaw
Attack vector: data-exfiltration
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40037
CVE-2026-41910
CVE-2026-41911
CVE-2026-41912
CVE-2026-41913
CVE-2026-41914
CVE-2026-41915
CVE-2026-41916
CVE-2026-42420
CVE-2026-42421
CVE-2026-42422
CVE-2026-42423
CVE-2026-42424
CVE-2026-42426
CVE-2026-42427
CVE-2026-42428
CVE-2026-42429
CVE-2026-42430
CVE-2026-42431
CVE-2026-42432
CWE: CWE-184
CWE-22
CWE-353
CWE-362
CWE-601
CWE-613
CWE-636
CWE-73
CWE-770
CWE-863
CWE-918
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data or headers to unintended origins.


Mitigations:

Architectural layers (MAESTRO):