Executive brief
OpenClaw is a browser automation platform that exposes local control endpoints for managing browser operations. The application failed to properly validate the origin of requests to state-changing endpoints (opening tabs, starting/stopping browsers, modifying storage), allowing malicious websites to trigger unauthorized actions through a victim's browser when the control service is running locally. This could enable attackers to manipulate browser state or session data without user consent.
Technical details
This vulnerability is a classic cross-site request forgery (CWE-352) affecting the browser control plane of OpenClaw. The affected endpoints—which handle state-changing operations via POST/PUT/PATCH/DELETE methods—bind to loopback addresses but lacked CSRF-style guards (Origin/Referer validation). Although loopback binding restricts network-based access, browsers still issue cross-origin requests to localhost from any website context, enabling an attacker to craft a malicious webpage that triggers unintended mutations (e.g., opening/closing tabs, manipulating cookies or storage) when visited by a user running OpenClaw. The fix validates incoming requests by rejecting mutations when the Origin/Referer header or Sec-Fetch-Site indicates a cross-site context. Patches are available in openclaw v2026.2.14 and clawdbot v2026.2.14; users can mitigate by enabling authentication on the browser control service.
Affected products
- openclaw openclaw <= 2026.2.13
- openclaw clawdbot <= 2026.1.24-3
Timeline
- 2026-02-18: disclosed
- 2026-02-14: patched: Fix commit b566b09f81e2b704bf9398d8d97d5f7a90aa94c3
- 2026-02-15: other: Public advisory release