CVE-2026-66418 in openclaw-dashboard
Summary
by MITRE • 07/31/2026
OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive Content-Security-Policy allowing inline event handlers, enabling the attacker-supplied payload to execute in the administrator's session and interact with authenticated endpoints including agent instruction file editing and configuration changes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/31/2026
The OpenClaw Dashboard v3.0.0 vulnerability represents a critical stored cross-site scripting flaw that demonstrates a fundamental failure in input sanitization and output escaping within the application's audit logging mechanism. This vulnerability resides in the authentication subsystem where failed login attempts are recorded without proper HTML escaping, creating a persistent vector for malicious payload injection. The flaw specifically manifests when an attacker submits a crafted username containing malicious script code during a failed login attempt, which gets stored verbatim in the system's audit log database.
The technical execution of this vulnerability leverages the application's permissive Content-Security-Policy configuration that permits inline event handlers and script execution, combined with the insecure rendering of log entries through innerHTML methods. When administrators access the notification panel to review audit logs, the stored malicious payloads are rendered directly into the web page without proper sanitization or encoding, allowing the JavaScript code to execute within the administrator's browser session. This creates a privileged execution context where the attacker's payload can interact with authenticated endpoints and perform actions that require administrative privileges.
The operational impact of this vulnerability is severe as it provides attackers with a persistent foothold within the system through a single successful injection attempt. Once executed, the malicious script can access all authenticated functionality available to administrators, including agent instruction file editing capabilities and configuration modification endpoints. The vulnerability's persistence stems from the stored nature of the XSS payload, meaning that any administrator who views the affected audit log entries will execute the attacker's code without requiring additional authentication or interaction from the victim. This makes the attack particularly dangerous as it can remain active for extended periods until the malicious log entry is manually removed.
The vulnerability aligns with CWE-079 (Cross-site Scripting) and represents a classic case of insecure input handling combined with inadequate output escaping in web applications. From an ATT&CK framework perspective, this vulnerability maps to T1566 (Phishing) and T1071.004 (Application Layer Protocol: DNS) as attackers can use it to establish persistent access and then leverage administrative privileges for further compromise. The lack of proper input validation in the login subsystem combined with insufficient output encoding in the audit display functionality creates a dangerous combination that enables privilege escalation through client-side exploitation.
Mitigation strategies must address both the immediate vulnerability and underlying architectural issues within the application's security model. Immediate remediation requires implementing strict HTML escaping for all user-supplied data stored in audit logs, ensuring that any potentially malicious content is rendered harmless before storage. The Content-Security-Policy should be hardened to prevent inline script execution and event handlers, enforcing a more restrictive security posture. Additionally, administrators should implement regular log sanitization procedures and consider implementing automated monitoring for suspicious patterns in authentication logs. Long-term solutions involve comprehensive input validation across all user-facing interfaces and adopting secure coding practices that prioritize output encoding over input filtering, following the principle of least privilege in audit logging to minimize potential attack surface areas.