CVE-2026-66418 tugcantopaloglu CVE debrief

Who should care

Administrators and users of OpenClaw Dashboard v3.0.0 should be aware of this vulnerability and take immediate action to protect their instances. Security teams and vulnerability managers should prioritize this CVE due to its high CVSS score and potential for administrator account takeover.

Technical summary

CVE-2026-66418 is a stored cross-site scripting vulnerability in OpenClaw Dashboard v3.0.0. The vulnerability allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive Content-Security-Policy allowing inline event handlers. This enables the attacker-supplied payload to execute in the administrator's session and interact with authenticated endpoints including agent instruction file editing and configuration changes. The CVSS score for this vulnerability is 9.3, indicating critical severity.

Defensive priority

CVE-2026-66418 is a stored cross-site scripting vulnerability in OpenClaw Dashboard v3.0.0 with a CVSS score of 9.3. Unaunthenticated remote attackers can inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive Content-Security-Policy allowing inline event handlers. This enables the attacker-supplied payload to execute in the administrator's session and interact with authenticated endpoints including agent instruction file editing and configuration changes. Due to the high CVSS score and potential for administrator account takeover, immediate defensive actions are required.

Recommended defensive actions

• Review and update OpenClaw Dashboard to the latest version if available.
• Implement compensating controls such as Web Application Firewalls (WAFs) to detect and prevent cross-site scripting attacks.
• Monitor OpenClaw Dashboard instances for suspicious activity, especially in the audit log and notification panel.
• Restrict access to the notification panel to minimize the attack surface.
• Perform regular security audits and vulnerability assessments to identify potential weaknesses.

Evidence notes

The CVE record and NVD entry provide details on the stored cross-site scripting vulnerability in OpenClaw Dashboard v3.0.0. The vulnerability allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request. The payload can execute in the administrator's session when they open the notification panel due to the permissive Content-Security-Policy allowing inline event handlers. However, the corpus does not provide information on the vendor's response or remediation efforts.

Official resources