# CVE-2026-26317: OpenClaw cross-site request forgery in browser mutation endpoints

Source: https://junglewise.ai/threats/cve-2026-26317-openclaw-csrf-in-loopback-browser-mutation-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26317 · Severity: low · CVSS 3.1 · Published 2026-02-18

OpenClaw is a browser automation platform that exposes local control endpoints for managing browser operations. The application failed to properly validate the origin of requests to state-changing endpoints (opening tabs, starting/stopping browsers, modifying storage), allowing malicious websites to trigger unauthorized actions through a victim's browser when the control service is running locally. This could enable attackers to manipulate browser state or session data without user consent.

Technologies: [clawdbot (npm)](https://junglewise.ai/threats/technologies/clawdbot), [Openclaw](https://junglewise.ai/threats/technologies/openclaw). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Openclaw](https://junglewise.ai/threats/vendors/openclaw).

## Quick answers

**Is CVE-2026-26317 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26317 being exploited in the wild.

**How severe is CVE-2026-26317?** Low severity, with a CVSS score of 3.1, published 18 February 2026.

**Which products and versions are affected?** clawdbot (npm) SEMVER:introduced=0,last_affected=2026.1.24-3; Openclaw <= 2026.2.13.

**Is there a fix for CVE-2026-26317?** A patch was published on 2026-02-14: Fix commit b566b09f81e2b704bf9398d8d97d5f7a90aa94c3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26317 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26317?** Check whether you run clawdbot (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a classic cross-site request forgery (CWE-352) affecting the browser control plane of OpenClaw. The affected endpoints—which handle state-changing operations via POST/PUT/PATCH/DELETE methods—bind to loopback addresses but lacked CSRF-style guards (Origin/Referer validation). Although loopback binding restricts network-based access, browsers still issue cross-origin requests to localhost from any website context, enabling an attacker to craft a malicious webpage that triggers unintended mutations (e.g., opening/closing tabs, manipulating cookies or storage) when visited by a user running OpenClaw. The fix validates incoming requests by rejecting mutations when the Origin/Referer header or Sec-Fetch-Site indicates a cross-site context. Patches are available in openclaw v2026.2.14 and clawdbot v2026.2.14; users can mitigate by enabling authentication on the browser control service.

## Affected products

- openclaw openclaw <= 2026.2.13
- openclaw clawdbot <= 2026.1.24-3

## Identifiers

- CVE-2026-26317
- GHSA-3fqr-4cg8-h96q

## Timeline

- 2026-02-18: disclosed
- 2026-02-14: patched: Fix commit b566b09f81e2b704bf9398d8d97d5f7a90aa94c3
- 2026-02-15: other: Public advisory release

## References

- [https://github.com/openclaw/openclaw/security/advisories/GHSA-3fqr-4cg8-h96q](https://github.com/openclaw/openclaw/security/advisories/GHSA-3fqr-4cg8-h96q)
- [https://github.com/openclaw/openclaw/commit/b566b09f81e2b704bf9398d8d97d5f7a90aa94c3](https://github.com/openclaw/openclaw/commit/b566b09f81e2b704bf9398d8d97d5f7a90aa94c3)
- [https://github.com/openclaw/openclaw](https://github.com/openclaw/openclaw)
- [https://github.com/openclaw/openclaw/releases/tag/v2026.2.14](https://github.com/openclaw/openclaw/releases/tag/v2026.2.14)

## Related threats

- [OpenClaw incorrect authorization in mcp.app.view method](https://junglewise.ai/threats/cve-2026-102807-openclaw-before-2026-9-4-contains-an-incorrect-authorization)
- [OpenClaw incorrect authorization in Gateway media root allowlist](https://junglewise.ai/threats/cve-2026-102806-openclaw-before-2026-9-5-contains-an-incorrect-authorization)
- [OpenClaw exec approval bypass in Google Meet node commands](https://junglewise.ai/threats/cve-2026-100599-openclaw-versions-2026-5-1-through-2026-7-0-fail-to-apply-the)
- [OpenClaw Signal approval reaction binding logic error](https://junglewise.ai/threats/cve-2026-100598-openclaw-npm-package-openclaw-before-2026-7-1-incorrectly-binds)
- [OpenClaw time-of-check time-of-use race condition in filesystem operations](https://junglewise.ai/threats/cve-2026-100597-openclaw-npm-package-openclaw-before-2026-7-1-is-vulnerable-to-a)