CVE-2026-66421: OpenClaw stored XSS enables admin

CISO Take

A stored cross-site scripting flaw in OpenClaw Dashboard lets an unauthenticated attacker inject an HTML payload into an agent's session transcript that executes in the administrator's browser the moment they view it, without needing any admin credentials. Because the payload rides inside agent conversation messages processed by the sessions API, any actor who can get content into a monitored agent's transcript can pivot into full admin account takeover: session token theft and unauthorized calls to administrative endpoints, including rewriting the agent's own instruction files. The blast radius is currently narrow — 4 known downstream dependents, no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template observed — but the CVSS 9.3 rating and the changed-scope, high-confidentiality/integrity vector reflect how directly this converts a low-friction XSS into control-plane compromise of the agent itself. With no patched version listed yet, treat this as unpatched: strip or encode HTML in transcript rendering, stop interpolating agent messages into innerHTML unsanitized, and monitor admin sessions for anomalous instruction-file edits until a fix ships.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity, currently low observed exploitation. Exploitability is moderate-to-high: no authentication is required to plant the payload (PR:N) and the injection point — an agent transcript message rendered via innerHTML — is low-complexity to hit (AC:L) for anyone able to influence what an agent logs or says, including via content an agent later echoes into its transcript. The scope change (S:C) plus high confidentiality and integrity impact mean a successful hit doesn't just deface the dashboard — it steals the admin's session and permits rewriting agent instruction files, hijacking the agent's future behavior. Mitigating factors: user interaction is required (an admin must view the poisoned session), there is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template observed — so this looks pre-weaponization rather than actively exploited in the wild. That combination puts it firmly in the 'patch before it's weaponized' bracket rather than an active-exploitation emergency.

How does the attack unfold?

Payload Injection

Attacker submits a crafted message containing an img tag with an onerror payload via the public-facing sessions API, staying within the 60-character rendering budget.

AML.T0049

Stored XSS Execution

The unsanitized payload is stored in the session transcript and executes in the administrator's browser when they view the dashboard's default landing page.

Session Theft & Privilege Abuse

The executed script exfiltrates the admin's session token, which the attacker replays to call authenticated administrative endpoints.

AML.T0091.000

Agent Hijack via Config Modification

Using the stolen admin session, the attacker rewrites the agent's instruction files, achieving persistent control over agent behavior.

AML.T0081

Payload Injection

Attacker submits a crafted message containing an img tag with an onerror payload via the public-facing sessions API, staying within the 60-character rendering budget.

AML.T0049

Stored XSS Execution

The unsanitized payload is stored in the session transcript and executes in the administrator's browser when they view the dashboard's default landing page.

Session Theft & Privilege Abuse

The executed script exfiltrates the admin's session token, which the attacker replays to call authenticated administrative endpoints.

AML.T0091.000

Agent Hijack via Config Modification

Using the stolen admin session, the attacker rewrites the agent's instruction files, achieving persistent control over agent behavior.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C High

I High

A None

What should I do?

1 step

No patched version is listed in the available advisory data — treat as unpatched and prioritize compensating controls. Restrict access to the OpenClaw Dashboard to a trusted admin network/VPN and enforce MFA on admin accounts to limit blast radius from session theft. If self-hosting or forking OpenClaw, patch the transcript rendering path to HTML-encode all message content before interpolation instead of using unsanitized innerHTML, or apply a strict CSP that blocks inline event handlers and inline scripts on the dashboard origin. Monitor for anomalous admin-session activity, especially unexpected calls to agent instruction-file modification endpoints, and rotate session tokens if compromise is suspected. Treat agent transcript content as untrusted end-to-end — sanitize at ingestion in the sessions API, not only at render time. Track the vendor repo (github.com/tugcantopaloglu/openclaw-dashboard) for a patch release and upgrade as soon as one ships.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Data Leakage Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated, tracked, and documented

OWASP LLM Top 10

LLM02 - Insecure Output Handling

Frequently Asked Questions

What is CVE-2026-66421?

A stored cross-site scripting flaw in OpenClaw Dashboard lets an unauthenticated attacker inject an HTML payload into an agent's session transcript that executes in the administrator's browser the moment they view it, without needing any admin credentials. Because the payload rides inside agent conversation messages processed by the sessions API, any actor who can get content into a monitored agent's transcript can pivot into full admin account takeover: session token theft and unauthorized calls to administrative endpoints, including rewriting the agent's own instruction files. The blast radius is currently narrow — 4 known downstream dependents, no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template observed — but the CVSS 9.3 rating and the changed-scope, high-confidentiality/integrity vector reflect how directly this converts a low-friction XSS into control-plane compromise of the agent itself. With no patched version listed yet, treat this as unpatched: strip or encode HTML in transcript rendering, stop interpolating agent messages into innerHTML unsanitized, and monitor admin sessions for anomalous instruction-file edits until a fix ships.

Is CVE-2026-66421 actively exploited?

No confirmed active exploitation of CVE-2026-66421 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-66421?

No patched version is listed in the available advisory data — treat as unpatched and prioritize compensating controls. Restrict access to the OpenClaw Dashboard to a trusted admin network/VPN and enforce MFA on admin accounts to limit blast radius from session theft. If self-hosting or forking OpenClaw, patch the transcript rendering path to HTML-encode all message content before interpolation instead of using unsanitized innerHTML, or apply a strict CSP that blocks inline event handlers and inline scripts on the dashboard origin. Monitor for anomalous admin-session activity, especially unexpected calls to agent instruction-file modification endpoints, and rotate session tokens if compromise is suspected. Treat agent transcript content as untrusted end-to-end — sanitize at ingestion in the sessions API, not only at render time. Track the vendor repo (github.com/tugcantopaloglu/openclaw-dashboard) for a patch release and upgrade as soon as one ships.

What systems are affected by CVE-2026-66421?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agent orchestration dashboards.

What is the CVSS score for CVE-2026-66421?

CVE-2026-66421 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagent orchestration dashboards

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute within the 60-character rendering budget, which is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page, allowing theft of session tokens and unauthorized calls to authenticated administrative endpoints including agent instruction file modification.

Exploitation Scenario

An attacker crafts a message — for example via a channel an OpenClaw agent monitors, or directly through the sessions API — containing an <img> tag with a malicious onerror handler, fit within the 60-character rendering budget the advisory describes. The payload is stored unmodified in the session transcript. When an administrator opens the dashboard's default landing page to review agent activity, the stored payload executes in their authenticated browser session, exfiltrating their session token to an attacker-controlled endpoint. Using the stolen token, the attacker replays authenticated requests against administrative endpoints — including the endpoint that modifies the agent's instruction files — silently rewriting the agent's behavior while appearing to act as the legitimate admin.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.