Home / Vulnerability Intelligence / CVE-2026-32902

CVE-2026-32902 - Vulnerability Analysis

HighCVSS: 8.3

Last Updated: March 23, 2026

OpenClaw - Server Side Request Forgery

Published: March 23, 2026Updated: March 23, 2026Remote Exploitable

Overview

OpenClaw < 2026.3.1 contains a server-side request forgery caused by improper validation in web_search citation redirect resolution, letting attackers trigger internal network requests from the gateway host, exploit requires attacker to influence citation redirect targets.

Severity & Score

Severity: High

CVSS Score: 8.3

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can make the server send requests to internal network destinations, potentially accessing sensitive internal resources.

Mitigation

Update to version 2026.3.1 or later.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 23, 2026

🟠 CVE-2026-32902 - High (8.3) OpenClaw before 2026.3.1 contains a server-side request forgery vulnerability in web_search citation redirect resolution that allows attackers to target private-network destinations. Attackers who influence citation redirect targets can trigger in... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32902/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 23, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-32902
Severity: High
CVSS Score: 8.3
Type: server_side_request_forgery
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-918

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS Score

0.0%Probability of exploitation in the next 30 days