GHSA-9q7v-8mr7-g23p: OpenClaw: SSRF in marketplace fetch hits internal AI infra

Published April 2, 2026

CISO Take

OpenClaw's unguarded fetch() in its marketplace plugin downloader allows any user who can trigger a plugin install to pivot into internal networks — including Ollama model servers, cloud metadata endpoints, and internal AI services. Patch to 2026.3.31 immediately; if you can't, disable marketplace plugin installs at the application or network layer. This is medium severity but trivially exploitable in environments where AI tooling sits on a flat internal network.

What is the risk?

Medium severity with meaningful blast radius in typical AI/ML deployments. SSRF via fetch() is trivial to weaponize — no AI expertise required, just a crafted URL. The real risk is architectural: AI platforms like OpenClaw commonly run with broad internal network access to model servers, data pipelines, and cloud APIs. The Ollama discovery vector is partially mitigated (operator-configured trust model), but the marketplace archive-fetch vector is unambiguous and unmitigated pre-patch. Cloud-hosted deployments are at highest risk due to IMDS exposure (AWS 169.254.169.254, GCP metadata.google.internal).

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	npm	<= 2026.3.28	`2026.3.31`
3 dependents32% patched~5d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

5 steps

Patch immediately
Upgrade to openclaw >= 2026.3.31 (npm: npm install openclaw@latest).
Workaround if patching is blocked
Disable marketplace plugin downloads at the application level or block outbound HTTP from the OpenClaw server via firewall/egress rules.
Network-level defense
Enforce egress allowlisting — AI application servers should only reach known external endpoints, not arbitrary URLs. Block access to 169.254.169.254, 100.100.100.200 (Alibaba IMDS), and internal RFC1918 ranges from the OpenClaw process.
Detection
Alert on HTTP requests from your AI application servers to cloud metadata IPs or internal subnet ranges. Review application logs for marketplace download events with internal/private IP destinations.
Audit
Check currently installed plugins for unexpected origins — malicious plugins may have been fetched before patching.

How is it classified?

Supply ChainData ExtractionAuth BypassPluginInferenceAgentAML.T0010.001- AI Software AML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art.15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3-AI System Security

NIST AI RMF

GOVERN-6.2-Policies and procedures are in place for AI risk management

OWASP LLM Top 10

LLM03:2025-Supply Chain VulnerabilitiesLLM06:2025-Excessive Agency

Frequently Asked Questions

What is GHSA-9q7v-8mr7-g23p?

Is GHSA-9q7v-8mr7-g23p actively exploited?

No confirmed active exploitation of GHSA-9q7v-8mr7-g23p has been reported, but organizations should still patch proactively.

How to fix GHSA-9q7v-8mr7-g23p?

1. **Patch immediately**: Upgrade to openclaw >= 2026.3.31 (npm: `npm install openclaw@latest`). 2. **Workaround if patching is blocked**: Disable marketplace plugin downloads at the application level or block outbound HTTP from the OpenClaw server via firewall/egress rules. 3. **Network-level defense**: Enforce egress allowlisting — AI application servers should only reach known external endpoints, not arbitrary URLs. Block access to 169.254.169.254, 100.100.100.200 (Alibaba IMDS), and internal RFC1918 ranges from the OpenClaw process. 4. **Detection**: Alert on HTTP requests from your AI application servers to cloud metadata IPs or internal subnet ranges. Review application logs for marketplace download events with internal/private IP destinations. 5. **Audit**: Check currently installed plugins for unexpected origins — malicious plugins may have been fetched before patching.

What systems are affected by GHSA-9q7v-8mr7-g23p?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Plugin/extension systems, Model serving (Ollama), LLM inference platforms, Self-hosted LLM deployments.

What is the CVSS score for GHSA-9q7v-8mr7-g23p?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksPlugin/extension systemsModel serving (Ollama)LLM inference platformsSelf-hosted LLM deployments

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art.15

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN-6.2

OWASP LLM Top 10: LLM03:2025, LLM06:2025

What are the technical details?

Original Advisory

## Summary SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery ## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Keep the shipped marketplace archive-fetch SSRF, but narrow out the Ollama half because it is operator-configured and overlaps weaker trust-model or duplicate SSRF ground. ## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31` ## Fix Commit(s) - `8deb9522f3d2680820588b190adb4a2a52f3670b` — 2026-03-30T20:08:38+01:00 OpenClaw thanks @tdjackey for reporting.

Exploitation Scenario

An attacker with access to OpenClaw's marketplace plugin install feature (authenticated user or via an exposed API endpoint) crafts a plugin package URL pointing to an internal resource: `http://169.254.169.254/latest/meta-data/iam/security-credentials/` on AWS, or `http://10.0.0.5:11434/api/tags` to enumerate available Ollama models on an internal server. OpenClaw's marketplace download handler calls `fetch()` without validating the destination, executes the request from the server's network context, and returns the response body — potentially leaking IAM credentials, internal service details, or model inventories. In an agentic deployment where OpenClaw manages tool orchestration, compromised IAM credentials from the metadata service can be used to pivot into cloud storage (S3/GCS) containing training data or proprietary model weights.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.