The vulnerability stems from a request body replay flaw in the fetchWithSsrFGuard function. By causing a redirect to an unintended origin, an attacker can force the original request body or sensitive headers to be resent, leading to unauthorized data exposure. This weakness falls under the category of improper control over redirects, allowing information disclosure.

OpenClaw versions prior to 2026.3.31 are affected. The fix was applied in release 2026.4.8. Users running any earlier build, regardless of operating system, must review their install to determine if they are operating vulnerable code.

The CVSS score of 7.1 indicates moderate to high potential for exploitation, primarily impacting confidentiality through data leakage. The EPSS score is unknown, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild. However, the attack requires the ability to cause a cross‑origin redirect, which can be achieved by influencing user input or manipulating client requests in many web contexts.