CVE-2026-26317: OpenClaw cross-site request forgery in browser mutation endpoints

CVE-2026-26317 · Severity: low · CVSS 3.1 · Published 2026-02-18

OpenClaw is a browser automation platform that exposes local control endpoints for managing browser operations. The application failed to properly validate the origin of requests to state-changing endpoints (opening tabs, starting/stopping browsers, modifying storage), allowing malicious websites to trigger unauthorized actions through a victim's browser when the control service is running locally. This could enable attackers to manipulate browser state or session data without user consent.

Technologies: clawdbot (npm), Openclaw. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-26317 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26317 being exploited in the wild.
How severe is CVE-2026-26317?
Low severity, with a CVSS score of 3.1, published 18 February 2026.
Which products and versions are affected?
clawdbot (npm) SEMVER:introduced=0,last_affected=2026.1.24-3; Openclaw <= 2026.2.13.
Is there a fix for CVE-2026-26317?
A patch was published on 2026-02-14: Fix commit b566b09f81e2b704bf9398d8d97d5f7a90aa94c3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26317 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-26317?
Check whether you run clawdbot (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a classic cross-site request forgery (CWE-352) affecting the browser control plane of OpenClaw. The affected endpoints—which handle state-changing operations via POST/PUT/PATCH/DELETE methods—bind to loopback addresses but lacked CSRF-style guards (Origin/Referer validation). Although loopback binding restricts network-based access, browsers still issue cross-origin requests to localhost from any website context, enabling an attacker to craft a malicious webpage that triggers unintended mutations (e.g., opening/closing tabs, manipulating cookies or storage) when visited by a user running OpenClaw. The fix validates incoming requests by rejecting mutations when the Origin/Referer header or Sec-Fetch-Site indicates a cross-site context. Patches are available in openclaw v2026.2.14 and clawdbot v2026.2.14; users can mitigate by enabling authentication on the browser control service.

Affected products

  • openclaw openclaw <= 2026.2.13
  • openclaw clawdbot <= 2026.1.24-3

Identifiers

  • CVE-2026-26317
  • GHSA-3fqr-4cg8-h96q

Timeline

  • 2026-02-18: disclosed
  • 2026-02-14: patched: Fix commit b566b09f81e2b704bf9398d8d97d5f7a90aa94c3
  • 2026-02-15: other: Public advisory release

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.