OpenClaw Dashboard Critical XSS Flaw Found

OpenClaw Dashboard version 3.0.0 contains a critical stored cross-site scripting (XSS) vulnerability, tracked as CVE-2026-66418. This flaw allows an unauthenticated remote attacker to inject malicious scripts into the system's audit logs, which are then executed within an administrator's browser session.

What's at Risk

The vulnerability affects OpenClaw Dashboard v3.0.0. Organizations deploying this software in internet-facing environments are at the highest level of risk, as the exploitation vector does not require prior authentication. Because the payload executes within the context of an administrator's session, any system relying on this dashboard for management tasks is potentially exposed to unauthorized configuration changes and file manipulation.

How the Flaw Works

Stored XSS occurs when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. In this class of vulnerability, the malicious script is permanently stored on the target server, such as in a database, forum post, or log file. When an unsuspecting user, often an administrator, views the stored data, the browser interprets the injected script as legitimate code originating from the trusted application.

This type of flaw typically grants an attacker the ability to bypass security controls by executing actions on behalf of the victim. If the victim has high-level privileges, the attacker can effectively gain control over the application's administrative functions, potentially leading to full account takeover, data exfiltration, or the modification of critical system settings.

How to Protect Your Systems

• Identify and audit all internet-facing instances of OpenClaw Dashboard v3.0.0 immediately.
• Monitor system audit logs for suspicious entries containing HTML tags or script-like characters.
• Restrict access to the dashboard interface to trusted IP ranges or VPN-only connections.
• Implement or tighten Content-Security-Policy (CSP) headers to prevent the execution of inline scripts and unauthorized event handlers.
• Apply vendor-provided security patches as soon as they become available to remediate the unescaped rendering of log data.

With a CVSS score of 9.3, this vulnerability represents a critical risk to the integrity and security of the OpenClaw platform. Given that the flaw allows for the manipulation of agent instruction files and configuration settings, immediate action is required to mitigate the risk of unauthorized administrative access.