OpenClaw/Clawdbot/Moltbot up to 2026.2.13 clickjacking

Summaryinfo

A vulnerability was found in OpenClaw, Clawdbot and Moltbot up to 2026.2.13. It has been rated as problematic. This vulnerability affects unknown code. This manipulation causes clickjacking. This vulnerability appears as CVE-2026-26320. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in OpenClaw, Clawdbot and Moltbot up to 2026.2.13 and classified as problematic. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a clickjacking vulnerability. The CWE definition for the vulnerability is CWE-451. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks. As an impact it is known to affect integrity. The summary by CVE is:

OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked "Run." At the time of writing, the OpenClaw macOS desktop client is still in beta. In versions 2026.2.6 through 2026.2.13, an attacker could pad the message with whitespace to push a malicious payload outside the visible preview, increasing the chance a user approves a different message than the one that is actually executed. If a user runs the deep link, the agent may perform actions that can lead to arbitrary command execution depending on the user's configured tool approvals/allowlists. This is a social-engineering mediated vulnerability: the confirmation prompt could be made to misrepresent the executed message. The issue is fixed in 2026.2.14. Other mitigations include not approve unexpected "Run OpenClaw agent?" prompts triggered while browsing untrusted sites and usingunattended deep links only with a valid `key` for trusted personal automations.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-26320 since 02/13/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1566.003 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 299796 (OpenClaw 2026.2.6 < 2026.2.14 Deep Link Message Truncation (macOS) (GHSA-7q2j-c4q5-rm27)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2026.2.14 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 28d9dd7a772501ccc3f71457b4adfee79084fe6f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (299796). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Artificial Intelligence Software

Name

• Clawdbot
• Moltbot
• OpenClaw

Version

• 2026.2.0
• 2026.2.1
• 2026.2.2
• 2026.2.3
• 2026.2.4
• 2026.2.5
• 2026.2.6
• 2026.2.7
• 2026.2.8
• 2026.2.9
• 2026.2.10
• 2026.2.11
• 2026.2.12
• 2026.2.13

License

• open-source

Website

• Product: https://github.com/openclaw/openclaw/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion