CVE-2026-26317 json
OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints
published 2026-02-18 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-8433 , GHSA-3fqr-4cg8-h96q
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins. A malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane (for example opening tabs, starting/stopping the browser, mutating storage/cookies) if the browser control service is reachable on loopback in the victim's browser context. Starting in version 2026.2.14, mutating HTTP methods (POST/PUT/PATCH/DELETE) are rejected when the request indicates a non-loopback Origin/Referer (or `Sec-Fetch-Site: cross-site`). Other mitigations include enabling browser control auth (token/password) and avoid running with auth disabled.
Patch / fix
- npm openclaw 2026.2.14
- openclaw openclaw 2026.2.14
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | openclaw | <2026.2.14 |
2026.2.14 |
| npm | clawdbot | <=2026.1.24-3 |
no fix listed |
Affected products
- openclaw openclaw
- openclaw clawdbot
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/openclaw/openclaw/commit/b566b09f81e2b704bf9398d8d97d5f7a90aa94c3
web, patch
-
github.com
/openclaw/openclaw/security/advisories/GHSA-3fqr-4cg8-h96q
web, patch, vendor-advisory
-
github.com
/openclaw/openclaw/releases/tag/v2026.2.14
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-26317
advisory
-
github.com
/openclaw/openclaw
package
Sources
- CVE List CVE-2026-26317
- GitHub Advisory GHSA-3fqr-4cg8-h96q
- NVD CVE-2026-26317
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.