CVE-2026-66418: OpenClaw stored XSS

CISO Take

OpenClaw Dashboard v3.0.0 lets any unauthenticated attacker plant a malicious script simply by submitting it as the 'username' in a failed login attempt — the payload lands verbatim in the audit log and detonates the moment an administrator opens the notification panel, because the log viewer renders entries via innerHTML under a Content-Security-Policy that still allows inline event handlers. For a CISO, the blast radius is the agent itself, not just the browser: the hijacked admin session can be used to rewrite agent instruction files and configuration, meaning a trivial web bug becomes a path to persistent, attacker-controlled agent behavior. There's no CISA KEV listing, EPSS score, or nuclei template yet, but a public GitHub write-up titled 'Unauthenticated Stored XSS Leading to Administrator Account Takeover' already documents the exploitation path, so treat public availability of exploit knowledge as effectively confirmed even without a scored EPSS. Given the 9.3 CVSS, zero required privileges, and low attack complexity, prioritize this over its EPSS-less status: sanitize/escape all username input before logging and rendering, replace innerHTML with safe DOM APIs in the notification panel, and tighten the CSP to drop unsafe-inline event handlers. Until a patched release ships, restrict dashboard admin access to a trusted network segment and audit recent login logs and agent instruction files for tampering.

Sources: NVD VulnCheck GitHub ATLAS

What is the risk?

Critical. CVSS 9.3 reflects an unauthenticated, network-reachable, low-complexity injection point (AV:N/AC:L/PR:N) that only requires a single passive administrator action (UI:R — opening the notification panel), not active social engineering. There is no confirmed active exploitation (not in CISA KEV), no EPSS score yet, and no nuclei scanner template, so opportunistic mass-scanning risk is currently low. However, a public GitHub PoC/write-up already exists, which materially raises near-term exploitation likelihood versus a typical unscored CVE, and the impact is high (S:C — scope change into the admin's authenticated context) with a direct path to agent configuration endpoints. Any organization running OpenClaw Dashboard with an internet- or intranet-exposed login form should treat this as urgent regardless of missing EPSS/KEV signals.

How does the attack unfold?

Initial Access

Attacker submits a crafted POST request to the login endpoint with an XSS payload as the username, requiring no authentication.

AML.T0049

Log Poisoning

The failed login attempt, including the unsanitized payload, is recorded verbatim into the dashboard's audit log.

Triggered Execution

An administrator opens the notification panel; the log entry is rendered via innerHTML under a permissive CSP, executing the payload in the admin's authenticated session.

AML.T0011

Agent Hijack

The script abuses the admin session to call agent configuration endpoints, rewriting agent instruction files and settings for persistent attacker control.

AML.T0081

Initial Access

Attacker submits a crafted POST request to the login endpoint with an XSS payload as the username, requiring no authentication.

AML.T0049

Log Poisoning

The failed login attempt, including the unsanitized payload, is recorded verbatim into the dashboard's audit log.

Triggered Execution

An administrator opens the notification panel; the log entry is rendered via innerHTML under a permissive CSP, executing the payload in the admin's authenticated session.

AML.T0011

Agent Hijack

The script abuses the admin session to call agent configuration endpoints, rewriting agent instruction files and settings for persistent attacker control.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C High

I High

A None

What should I do?

1 step

1) Patch: upgrade to a fixed OpenClaw Dashboard release once published (no patched version identified in available references — track the vendor advisory at vulncheck.com/advisories/openclaw-dashboard-stored-xss-via-failed-login-username-field). 2) Sanitize/encode the username field server-side before writing to the audit log, and HTML-escape all log content again at render time — never trust already-logged data as safe. 3) Replace innerHTML rendering of the notification panel with textContent or a DOM-sanitizing library so injected markup can't execute. 4) Tighten the CSP to remove any inline-script/event-handler allowance ('unsafe-inline'), using a nonce- or hash-based policy instead. 5) Detection: scan audit logs for username values containing HTML tags, angle brackets, or 'on*=' event-handler patterns; alert on any agent instruction file or config change immediately following an admin notification-panel session. 6) Compensating control until patched: restrict the dashboard's login endpoint and admin panel to a trusted network/VPN, and rate-limit failed login attempts to reduce log-poisoning attempts.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework AML.T0011 - User Execution AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.1 - Operational planning and control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-66418?

OpenClaw Dashboard v3.0.0 lets any unauthenticated attacker plant a malicious script simply by submitting it as the 'username' in a failed login attempt — the payload lands verbatim in the audit log and detonates the moment an administrator opens the notification panel, because the log viewer renders entries via innerHTML under a Content-Security-Policy that still allows inline event handlers. For a CISO, the blast radius is the agent itself, not just the browser: the hijacked admin session can be used to rewrite agent instruction files and configuration, meaning a trivial web bug becomes a path to persistent, attacker-controlled agent behavior. There's no CISA KEV listing, EPSS score, or nuclei template yet, but a public GitHub write-up titled 'Unauthenticated Stored XSS Leading to Administrator Account Takeover' already documents the exploitation path, so treat public availability of exploit knowledge as effectively confirmed even without a scored EPSS. Given the 9.3 CVSS, zero required privileges, and low attack complexity, prioritize this over its EPSS-less status: sanitize/escape all username input before logging and rendering, replace innerHTML with safe DOM APIs in the notification panel, and tighten the CSP to drop unsafe-inline event handlers. Until a patched release ships, restrict dashboard admin access to a trusted network segment and audit recent login logs and agent instruction files for tampering.

Is CVE-2026-66418 actively exploited?

No confirmed active exploitation of CVE-2026-66418 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-66418?

1) Patch: upgrade to a fixed OpenClaw Dashboard release once published (no patched version identified in available references — track the vendor advisory at vulncheck.com/advisories/openclaw-dashboard-stored-xss-via-failed-login-username-field). 2) Sanitize/encode the username field server-side before writing to the audit log, and HTML-escape all log content again at render time — never trust already-logged data as safe. 3) Replace innerHTML rendering of the notification panel with textContent or a DOM-sanitizing library so injected markup can't execute. 4) Tighten the CSP to remove any inline-script/event-handler allowance ('unsafe-inline'), using a nonce- or hash-based policy instead. 5) Detection: scan audit logs for username values containing HTML tags, angle brackets, or 'on*=' event-handler patterns; alert on any agent instruction file or config change immediately following an admin notification-panel session. 6) Compensating control until patched: restrict the dashboard's login endpoint and admin panel to a trusted network/VPN, and rate-limit failed login attempts to reduce log-poisoning attempts.

What systems are affected by CVE-2026-66418?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-66418?

CVE-2026-66418 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive Content-Security-Policy allowing inline event handlers, enabling the attacker-supplied payload to execute in the administrator's session and interact with authenticated endpoints including agent instruction file editing and configuration changes.

Exploitation Scenario

An unauthenticated attacker sends a POST request to the OpenClaw Dashboard login endpoint with a deliberately invalid username containing an XSS payload (e.g., an image tag with an onerror handler). The failed login is recorded verbatim into the audit log with no sanitization. Later, an administrator opens the dashboard's notification panel to review recent activity; the panel renders the log entry via innerHTML, and because the CSP permits inline event handlers, the payload executes with the full privileges of the administrator's authenticated session. The script then silently calls the dashboard's agent configuration API to rewrite the agent's instruction file — for example injecting new instructions that redirect the agent to exfiltrate data or perform unauthorized actions — or modifies dashboard settings to create a persistent backdoor, all without the administrator noticing anything beyond a normal page load.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.