Vulnerability Details CVE-2026-66418
OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive Content-Security-Policy allowing inline event handlers, enabling the attacker-supplied payload to execute in the administrator's session and interact with authenticated endpoints including agent instruction file editing and configuration changes.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 37.7%
CVSS Severity
CVSS v3 Score 9.3
References
- https://github.com/theopaid/Unauthenticated-Stored-Cross-Site-Scripting-Leading-To-Administrator-Account-Takeover
- https://github.com/tugcantopaloglu/openclaw-dashboard
- https://www.vulncheck.com/advisories/openclaw-dashboard-stored-xss-via-failed-login-username-field
- https://github.com/theopaid/Unauthenticated-Stored-Cross-Site-Scripting-Leading-To-Administrator-Account-Takeover
Products affected by CVE-2026-66418
-
cpe:2.3:a:tugcantopaloglu:openclaw_agent_dashboard:*