{"id":"EUVD-2026-20781","enisaUuid":"e375745f-1b06-398c-91fc-479a26f90d82","description":"OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data or headers to unintended origins.","datePublished":"Apr 8, 2026, 9:35:29 PM","dateUpdated":"Oct 29, 2026, 9:15:37 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qx8j-g322-qj6m\nhttps://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5\nhttps://www.vulncheck.com/advisories/openclaw-unsafe-request-body-replay-via-fetchwithssrfguard-cross-origin-redirects\n","aliases":"CVE-2026-40037\nGHSA-pg8g-f2hf-x82m\n","assigner":"VulnCheck","epss":0.31,"enisaIdProduct":[{"id":"6a05e223-32f3-35dd-a55d-987545535e72","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.8"}],"enisaIdVendor":[{"id":"f1137acc-4693-3ced-8970-af1be80768c2","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"7d3f6a38-3dd3-3866-999d-2b420d2dc8af","vulnerability":{"id":"GHSA-pg8g-f2hf-x82m","description":"Duplicate Advisory: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects","datePublished":"Apr 9, 2026, 12:31:59 AM","dateUpdated":"Apr 10, 2026, 8:24:54 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qx8j-g322-qj6m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40037\nhttps://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5\nhttps://www.vulncheck.com/advisories/openclaw-unsafe-request-body-replay-via-fetchwithssrfguard-cross-origin-redirects\n","enisa_id":"EUVD-2026-20781\n","aliases":"GHSA-pg8g-f2hf-x82m\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c6682812-4704-3369-92a3-4d43f6347b6a","vulnerability":{"id":"CVE-2026-40037","description":"OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data or headers to unintended origins.","datePublished":"Apr 8, 2026, 9:35:29 PM","dateUpdated":"Oct 29, 2026, 9:15:37 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qx8j-g322-qj6m\nhttps://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5\nhttps://www.vulncheck.com/advisories/openclaw-unsafe-request-body-replay-via-fetchwithssrfguard-cross-origin-redirects\n","enisa_id":"EUVD-2026-20781\n","assigner":"VulnCheck","epss":0.31,"dataProcessed":"Nov 1, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"d56f452d-7d20-3631-8209-06e18f8a686e","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.8"}],"vulnerabilityVendor":[{"id":"96cf5cb1-d4a4-316a-a184-3d210b08f9cb","vendor":{"name":"OpenClaw"}}]}},{"id":"cbcbc231-ee72-3115-9ca6-7cfce488f579","vulnerability":{"id":"GHSA-qx8j-g322-qj6m","description":"OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects","datePublished":"Apr 9, 2026, 5:37:08 PM","dateUpdated":"Apr 10, 2026, 8:24:59 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qx8j-g322-qj6m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40037\nhttps://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5\nhttps://github.com/openclaw/openclaw\nhttps://www.vulncheck.com/advisories/openclaw-unsafe-request-body-replay-via-fetchwithssrfguard-cross-origin-redirects\n","enisa_id":"EUVD-2026-20781\n","aliases":"CVE-2026-40037\nGHSA-qx8j-g322-qj6m\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"5b5a757d-253d-3082-a264-12077cb06c6b","advisory":{"id":"WID-SEC-W-2026-1035","description":"OpenClaw: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen oder andere, nicht näher spezifizierte Angriffe durchzuführen.","datePublished":"Apr 8, 2026, 10:00:00 PM","dateUpdated":"Apr 28, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1035.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1035\n","aliases":"CVE-2026-40037\nCVE-2026-41363\nCVE-2026-41911\nCVE-2026-41914\nCVE-2026-42429\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"94ecf6c7-37c3-3cc9-9091-5e5740055a8e","product":{"name":"OpenClaw","vendor":{"name":"n/a"}}},{"id":"f2fc5bcb-13b2-3656-8e08-cdd1b3372abe","product":{"name":"2026.4.8","vendor":{"name":"open source"}}}]}}]}