VulnSocial

CVE-2026-26317Disclosure(openclaw / openclaw)

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch openclaw openclaw systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins. A malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane (for example opening tabs, starting/stopping the browser, mutating storage/cookies) if the browser control service is reachable on loopback in the victim's browser context. Starting in version 2026.2.14, mutating HTTP methods (POST/PUT/PATCH/DELETE) are rejected when the request indicates a non-loopback Origin/Referer (or `Sec-Fetch-Site: cross-site`). Other mitigations include enabling browser control auth (token/password) and avoid running with auth disabled.

openclaw CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-352

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-02-18); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
openclaw
Products
openclaw

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-02-18: 1Mentions · 2026-02-20: 1Patch / Workaround · 2026-02-20: 1Technical Details · 2026-02-20: 102-1802-20
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • ‘BugBounty Writeups’@bbwriteups
    Disclosure

    "The 2026 OpenClaw Vulnerability Cluster (CVE‑2026‑26323, CVE‑2026‑26327, CVE‑2026‑26317…" by gm0 #BugBounty #Cybersecurity #Hacking #InfoSec https://blog.stackademic.com/the-2026-openclaw-vulnerability-cluster-cve-2026-26323-cve-2026-26327-cve-2026-26317-188eee2cade5

    Post summary

    A tweet promoting a blog post that announces a cluster of new OpenClaw vulnerabilities (CVE‑2026‑26323, CVE‑2026‑26327, CVE‑2026‑26317) without providing further technical or exploit details.

    0001050
    461 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-26317 OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Refer… https://www.cve.org/CVERecord?id=CVE-2026-26317

    Post summary

    CVE‑2026‑26317 is a CORS vulnerability in OpenClaw's localhost mutation routes, acknowledged in the CVE record and fixed by the 2026.2.14 release, with no evidence of PoC, exploitation, or mis‑attribution.

    00000115
    56.4K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities