CVE-2026-40037: OpenClaw SSRF Vulnerability

CVE-2026-40037 Overview

OpenClaw before version 2026.3.31 contains a request body replay vulnerability in the fetchWithSsrFGuard function that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data or headers to unintended origins. This vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site, also known as Open Redirect).

Critical Impact

Sensitive request data and headers can be exfiltrated to attacker-controlled origins through manipulated cross-origin redirects, potentially exposing authentication tokens, session data, and other confidential information.

Affected Products

• OpenClaw versions prior to 2026.3.31
• OpenClaw versions without the security patch released in 2026.4.8

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-40037 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-40037

Vulnerability Analysis

The vulnerability resides in the fetchWithSsrFGuard function within OpenClaw's network infrastructure layer. When processing HTTP requests that result in cross-origin redirects, the application fails to properly sanitize or strip request bodies before following the redirect. This allows sensitive data originally intended for a trusted origin to be forwarded to potentially malicious external domains.

The core issue stems from how the DNS pinning and proxy dispatch mechanisms interact during redirect handling. The original implementation performed DNS resolution and hostname pinning before determining whether a trusted environment proxy should be used, creating a window where request bodies could be replayed to unintended destinations.

Root Cause

The root cause is improper handling of request bodies during cross-origin redirect scenarios in the guarded fetch implementation. The DNS pinning resolution was being performed unconditionally before evaluating the trusted environment proxy configuration, which should have intercepted and properly handled the request flow. This sequencing error allowed request data to leak across origin boundaries when redirects occurred.

Attack Vector

An attacker can exploit this vulnerability through a network-based attack vector requiring user interaction. The attack scenario involves:

1. Setting up a malicious server that issues redirect responses to attacker-controlled domains
2. Tricking a user or application into making a request through OpenClaw's fetchWithSsrFGuard function to a seemingly legitimate URL
3. The malicious server responds with a redirect to the attacker's domain
4. OpenClaw replays the original request body (potentially containing sensitive data) to the attacker's domain

The following patch from the GitHub commit shows the security fix in src/infra/net/fetch-guard.ts:

     try {
       assertExplicitProxySupportsPinnedDns(parsedUrl, params.dispatcherPolicy, params.pinDns);
       await assertExplicitProxyAllowed(params.dispatcherPolicy, params.lookupFn, params.policy);
-      const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
-        lookupFn: params.lookupFn,
-        policy: params.policy,
-      });
       const canUseTrustedEnvProxy =
         mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured();
       if (canUseTrustedEnvProxy) {
         dispatcher = createHttp1EnvHttpProxyAgent();
       } else if (params.pinDns === false) {
         dispatcher = createPolicyDispatcherWithoutPinnedDns(params.dispatcherPolicy);
       } else {
+        const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+          lookupFn: params.lookupFn,
+          policy: params.policy,
+        });
         dispatcher = createPinnedDispatcher(pinned, params.dispatcherPolicy, params.policy);
       }

Source: GitHub Commit Details

The fix defers DNS pinning resolution until after the trusted environment proxy check, ensuring proper request handling flow and preventing request body replay across cross-origin redirects.

Detection Methods for CVE-2026-40037

Indicators of Compromise

• Unusual outbound requests to external domains immediately following legitimate requests through fetchWithSsrFGuard
• Network logs showing request bodies being sent to unexpected or untrusted origins
• HTTP redirect chains that cross origin boundaries while carrying sensitive payload data
• Anomalous DNS resolution patterns for unfamiliar external domains during fetch operations

Detection Strategies

• Monitor network traffic for HTTP redirects that result in request body forwarding to different origins
• Implement logging for all cross-origin redirect scenarios in the application's fetch layer
• Deploy web application firewall rules to detect and alert on suspicious redirect chains
• Analyze server logs for patterns of requests that result in unexpected redirect responses

Monitoring Recommendations

• Enable verbose logging for the fetchWithSsrFGuard function to track redirect behavior
• Configure network monitoring tools to alert on cross-origin data transfers following redirects
• Establish baseline metrics for normal redirect patterns and alert on deviations
• Monitor for connections to newly registered or suspicious domains in fetch operations

How to Mitigate CVE-2026-40037

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.8 or later which contains the security patch
• Review application logs for any signs of exploitation prior to patching
• Audit any systems that may have processed sensitive data through the vulnerable fetchWithSsrFGuard function
• Consider implementing additional redirect validation at the application layer as defense-in-depth

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.4.8. The patch modifies the order of operations in the fetch guard implementation, ensuring DNS pinning is only performed when necessary and after trusted proxy evaluation. For detailed patch information, refer to the GitHub Security Advisory and the commit details.

Workarounds

• Implement strict Content Security Policy (CSP) headers to limit redirect destinations
• Configure application-level redirect validation to reject cross-origin redirects
• Use a web application firewall to block or inspect requests involved in redirect chains
• Temporarily disable or isolate features that rely on fetchWithSsrFGuard until patching is complete

# Update OpenClaw to the patched version
npm update openclaw@2026.4.8

# Verify the installed version
npm list openclaw