CVE-2026-40037: OpenClaw request body replay leaks

CISO Take

OpenClaw's fetchWithSsrFGuard function incorrectly forwards request bodies — including authorization headers and API keys — when following cross-origin HTTP redirects, enabling any attacker who controls or influences a URL fetched by the agent to silently harvest sensitive credentials. An EPSS in the 85th percentile signals meaningful real-world exploitation interest despite the absence of a public proof-of-concept, and the CVSS Confidentiality impact is rated High. AI agents built on OpenClaw routinely carry privileged tokens scoped to enterprise APIs and internal tooling, meaning a single successful redirect is sufficient to pivot into downstream systems. Upgrade to OpenClaw 2026.4.8 immediately; if patching is not immediately feasible, restrict agent network egress to an explicit domain allowlist and audit all externally-supplied URLs in agent tool configurations.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium CVSS (6.5) with disproportionate real-world severity in agentic deployments. The attack is network-accessible, requires no privileges, and only needs the agent to perform an HTTP request — an operation central to most agentic workflows. EPSS at the 85th percentile indicates this class of redirect-replay flaw attracts active exploitation interest. In AI agent contexts, request bodies frequently carry bearer tokens, OAuth credentials, and structured payloads, raising the effective blast radius well beyond a generic open redirect. The 396 CVEs recorded against this package indicate a broad and mature attack surface. No CISA KEV listing and absence of a public exploit reduce immediate criticality, but the combination of high EPSS and High Confidentiality warrants prompt action.

How does the attack unfold?

Redirect Infrastructure Setup

Attacker registers a domain or compromises an existing endpoint configured to issue HTTP 302 redirects to attacker-controlled server infrastructure.

AML.T0008.002

Malicious URL Injection

Attacker plants the redirect URL in content the agent will retrieve — a poisoned RAG document, manipulated tool output, or externally-retrieved web resource — seeding it into the agent's task context.

AML.T0066

Redirect Replay Exploitation

Agent calls fetchWithSsrFGuard against the injected URL; OpenClaw follows the cross-origin redirect and replays the full request body including authorization headers to the attacker's server.

AML.T0049

Credential Exfiltration and Pivot

Attacker logs the forwarded credentials and uses them to access enterprise systems the agent was authorized to reach, pivoting without triggering agent-level anomaly detection.

AML.T0025

Redirect Infrastructure Setup

Attacker registers a domain or compromises an existing endpoint configured to issue HTTP 302 redirects to attacker-controlled server infrastructure.

AML.T0008.002

Malicious URL Injection

Attacker plants the redirect URL in content the agent will retrieve — a poisoned RAG document, manipulated tool output, or externally-retrieved web resource — seeding it into the agent's task context.

AML.T0066

Redirect Replay Exploitation

Agent calls fetchWithSsrFGuard against the injected URL; OpenClaw follows the cross-origin redirect and replays the full request body including authorization headers to the attacker's server.

AML.T0049

Credential Exfiltration and Pivot

Attacker logs the forwarded credentials and uses them to access enterprise systems the agent was authorized to reach, pivoting without triggering agent-level anomaly detection.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: upgrade OpenClaw to 2026.4.8 or later (reference commit d7c3210c).
Interim workaround: enforce network egress controls at the proxy or firewall layer; block HTTP redirects to domains not on an explicit allowlist.
Audit agent tool configurations for externally-supplied or LLM-generated URLs and validate them against a domain allowlist at the application layer before the fetch executes.
Rotate any API keys, bearer tokens, and session credentials that may have been transmitted to external endpoints by agent HTTP calls since the vulnerability window (before 2026.4.8).
Review HTTP access logs on agent infrastructure for cross-origin redirects targeting unexpected or external domains during the exposure window.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Data Leakage Agent AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system operational controls

NIST AI RMF

MANAGE 2.2 - Risk treatment for identified AI risks

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-40037?

OpenClaw's fetchWithSsrFGuard function incorrectly forwards request bodies — including authorization headers and API keys — when following cross-origin HTTP redirects, enabling any attacker who controls or influences a URL fetched by the agent to silently harvest sensitive credentials. An EPSS in the 85th percentile signals meaningful real-world exploitation interest despite the absence of a public proof-of-concept, and the CVSS Confidentiality impact is rated High. AI agents built on OpenClaw routinely carry privileged tokens scoped to enterprise APIs and internal tooling, meaning a single successful redirect is sufficient to pivot into downstream systems. Upgrade to OpenClaw 2026.4.8 immediately; if patching is not immediately feasible, restrict agent network egress to an explicit domain allowlist and audit all externally-supplied URLs in agent tool configurations.

Is CVE-2026-40037 actively exploited?

No confirmed active exploitation of CVE-2026-40037 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-40037?

1. Patch: upgrade OpenClaw to 2026.4.8 or later (reference commit d7c3210c). 2. Interim workaround: enforce network egress controls at the proxy or firewall layer; block HTTP redirects to domains not on an explicit allowlist. 3. Audit agent tool configurations for externally-supplied or LLM-generated URLs and validate them against a domain allowlist at the application layer before the fetch executes. 4. Rotate any API keys, bearer tokens, and session credentials that may have been transmitted to external endpoints by agent HTTP calls since the vulnerability window (before 2026.4.8). 5. Review HTTP access logs on agent infrastructure for cross-origin redirects targeting unexpected or external domains during the exposure window.

What systems are affected by CVE-2026-40037?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Agentic RAG pipelines, Multi-agent orchestration systems, AI-powered web automation, Tool-augmented LLM deployments.

What is the CVSS score for CVE-2026-40037?

CVE-2026-40037 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksAgentic RAG pipelinesMulti-agent orchestration systemsAI-powered web automationTool-augmented LLM deployments

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06, LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data or headers to unintended origins.

Exploitation Scenario

An adversary registers a domain configured to issue HTTP 302 redirects to attacker-controlled infrastructure. They plant a reference to this URL in a document indexed by the target organization's RAG system — a poisoned PDF, a modified web page, or a manipulated tool result. When an OpenClaw agent retrieves the document as part of a legitimate task and calls fetchWithSsrFGuard to follow an embedded link, the agent follows the cross-origin redirect and replays the full request body — including Authorization headers scoped to internal APIs — to the attacker's server. The attacker logs the forwarded credentials and uses them to access the enterprise systems the agent was authorized to reach, pivoting silently without triggering agent-level anomaly detection.

Weaknesses (CWE)

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CWE-601 — URL Redirection to Untrusted Site ('Open Redirect'): The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.

Source: MITRE CWE corpus.