Which versions of OpenClaw Dashboard are affected by CVE-2026-66421?

OpenClaw Dashboard 1.1.0 contains a stored cross-site scripting vulnerability that enables unauthenticated attackers to compromise administrator accounts and modify agent instruction files.

How to fix or mitigate CVE-2026-66421?

Within 24 hours, conduct a complete inventory of OpenClaw Dashboard 1.1.0 deployments and audit all agent transcript messages and instruction files for evidence of compromise; immediately implement strict input validation and output encoding with Content Security Policy headers on the dashboard frontend, restrict network access to the unauthenticated sessions API where operationally feasible, and deploy Web Application Firewall rules to block XSS payloads. Within 7 days, perform forensic analysis of administrator session logs to identify unauthorized token usage, confirm no malicious agent instructions were injected, and review all recent agent outputs for signs of tampering. Within 30 days, monitor vendor security advisories for patch availability and establish a tested migration plan to upgrade to patched OpenClaw Dashboard versions; implement additional compensating controls such as admin session sandboxing or behavioral anomaly detection on sensitive API operations.

OpenClaw Dashboard CVE-2026-66421

Q: What is the CVSS score of CVE-2026-66421?

CVE-2026-66421 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-51337 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 VulnCheck

GHSA-hc44-65x2-rvc2

XSS Openclaw Dashboard Tugcantopaloglu

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Unauthenticated network injection (PR:N, AV:N) that requires an admin to view the page (UI:R) and runs in their privileged context (S:C) with token theft and admin actions giving C:H/I:H and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:21 vuln.today

CVE Published

Jul 30, 2026 - 22:16 cve.org

HIGH 8.8

DescriptionCVE.org

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute within the 60-character rendering budget, which is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page, allowing theft of session tokens and unauthorized calls to authenticated administrative endpoints including agent instruction file modification.

AnalysisAI

Stored cross-site scripting in OpenClaw Dashboard 1.1.0 lets unauthenticated remote attackers plant JavaScript in agent transcript messages that later executes in the administrator's authenticated browser session. Because the malicious message is submitted through the unauthenticated sessions API and rendered unsanitized via innerHTML on the default landing page, an attacker can steal admin session tokens and invoke privileged endpoints, including modifying agent instruction files. Publicly available exploit details exist in a dedicated advisory writeup; there is no evidence of active exploitation (not in CISA KEV), and the CVSS 4.0 base score is 8.8.

Technical ContextAI

The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS in a Node/JavaScript single-page dashboard for the OpenClaw agent platform (CPE cpe:2.3:a:tugcantopaloglu:openclaw-dashboard). Agent transcript messages received through the sessions API are persisted (specifically the lastMessage/session transcript field) and then interpolated directly into the DOM through innerHTML on the default landing page without HTML encoding or sanitization. Because innerHTML parses arbitrary markup, injected tags such as an <img> element with an onerror event handler are executed by the browser. A notable constraint is a 60-character rendering budget on the displayed message, which is small but comfortably large enough for a compact inline event-handler payload that bootstraps a larger script or exfiltration request.

RemediationAI

No vendor-released patched version was identified in the available data, so no fixed release can be cited without inventing a version number; monitor the upstream repository at https://github.com/tugcantopaloglu/openclaw-dashboard and the VulnCheck advisory for a corrected release. As specific compensating controls, stop rendering agent transcript messages via innerHTML and switch to textContent or a strict HTML-sanitization/output-encoding step on the sessions/lastMessage field so markup is never parsed (this is the durable fix and only affects any intentional rich formatting). As interim controls, restrict network access to the dashboard sessions API and landing page to trusted operators via a reverse proxy or firewall so untrusted parties cannot submit transcript messages (trade-off: breaks any legitimate remote agent message ingestion), and deploy a Content-Security-Policy that forbids inline script execution and event-handler attributes to neutralize the img/onerror class of payload (trade-off: may break inline scripts the app itself relies on and requires testing). Consult the theopaid advisory (https://github.com/theopaid/Stored-Cross-Site-Scripting-Via-Agent-Messages-Leading-To-Session-Token-Theft-openclaw-dashboard-) for payload specifics when validating the fix.