CVE-2026-26317: OpenClaw Personal AI Assistant CSRF Flaw

CVE-2026-26317 Overview

CVE-2026-26317 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in OpenClaw, a personal AI assistant. Versions prior to 2026.2.14 expose browser-facing localhost routes that accept cross-origin requests without validating Origin or Referer headers. A malicious website can issue browser-initiated requests against the victim's local OpenClaw control plane and trigger unauthorized state changes. Affected actions include opening browser tabs, starting or stopping the browser, and mutating storage or cookies. Loopback binding limits remote network exposure but does not prevent the victim's own browser from issuing the malicious requests.

Critical Impact
A malicious webpage visited by the victim can hijack the local OpenClaw browser control plane to manipulate browser state, sessions, and storage without user consent.

Affected Products

OpenClaw openclaw versions prior to 2026.2.14
Node.js based deployments of OpenClaw running with browser control auth disabled
Local installations exposing the browser control plane on loopback

Discovery Timeline

2026-02-19 - CVE-2026-26317 published to the National Vulnerability Database
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-26317

Vulnerability Analysis

The vulnerability stems from OpenClaw's local HTTP control plane accepting state-changing requests from any browser origin. The service binds to loopback, which prevents direct remote access but allows the victim's browser to act as a confused deputy. When the victim visits an attacker-controlled page, that page can issue POST, PUT, PATCH, or DELETE requests targeting http://127.0.0.1 or http://localhost on the OpenClaw control port.

Because the server did not enforce Origin, Referer, or Sec-Fetch-Site checks, those requests succeeded with the user's local privileges. Attackers can drive the browser remotely, opening tabs to phishing pages, terminating the browser session, or mutating stored cookies and credentials persisted by OpenClaw.

Root Cause

The root cause is missing CSRF protection on mutating HTTP methods exposed by the browser control service. The server treated loopback binding as a sufficient trust boundary and omitted origin validation. Running with browser control authentication disabled further removed the only remaining check on incoming requests.

Attack Vector

Exploitation requires user interaction: the victim must visit a malicious web page while OpenClaw is running locally. The attacker's page issues cross-origin fetch or form submissions against the loopback control endpoint. Because no origin validation is performed, the requests execute against the victim's local OpenClaw instance and mutate state.

No authentication is required when OpenClaw is configured without browser control auth. Refer to the GitHub Security Advisory GHSA-3fqr-4cg8-h96q for the full advisory and the patch commit b566b09 for the upstream fix.

Detection Methods for CVE-2026-26317

Indicators of Compromise

Unexpected browser tabs opened to unknown URLs while OpenClaw is running
Unexplained browser restarts, shutdowns, or session terminations initiated through the control plane
Modifications to browser cookies, local storage, or session data not initiated by the user
Inbound requests to 127.0.0.1 or localhost on the OpenClaw control port carrying cross-site Origin or Referer headers

Detection Strategies

Monitor local HTTP logs of the OpenClaw control service for POST, PUT, PATCH, or DELETE requests with Origin or Referer values outside the loopback set
Alert on requests containing Sec-Fetch-Site: cross-site directed at the OpenClaw loopback port
Correlate browser process restarts with recent web browsing activity to identify attacker pages

Monitoring Recommendations

Enable verbose request logging on the OpenClaw browser control service and forward logs to a centralized analytics platform
Track the installed OpenClaw version across managed hosts and flag any instance below 2026.2.14
Audit configuration files to identify deployments running with browser control authentication disabled

How to Mitigate CVE-2026-26317

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.14 or later, available from the GitHub Release v2026.2.14
Enable browser control authentication using a token or password and avoid running with auth disabled
Restart the OpenClaw service after upgrading to ensure the new origin checks are loaded

Patch Information

The fix landed in commit b566b09f81e2b704bf9398d8d97d5f7a90aa94c3 and shipped in OpenClaw 2026.2.14. Starting with that release, mutating HTTP methods (POST, PUT, PATCH, DELETE) are rejected when the request carries a non-loopback Origin or Referer, or when Sec-Fetch-Site: cross-site is present. See the GitHub Commit Update for the code changes.

Workarounds

Enable token or password authentication on the browser control plane until upgrade is possible
Avoid browsing untrusted websites while OpenClaw is running locally
Restrict OpenClaw to environments where the loopback interface is not shared with untrusted browser sessions

bash

# Configuration example: upgrade and verify the patched OpenClaw release
npm install -g openclaw@2026.2.14
openclaw --version
# Ensure browser control auth is enabled (token/password) per advisory guidance