OpenClaw betroffen von Cross-Site Request Forgery (CSRF) über Loopback-Browser-Mutationsendpunkte

The impact of CVE-2026-26317 stems from the lack of proper Origin/Referer validation on browser-facing mutation routes. While loopback binding limits remote exposure, it doesn't prevent malicious websites running in the victim's browser context from initiating requests. A successful exploit could allow an attacker to silently control aspects of the user's browser, such as opening new tabs, closing existing ones, starting or stopping the browser process, or even modifying browser storage and cookies. This could be leveraged for phishing attacks, data theft, or to inject malicious content into the user's browsing session. The potential for abuse is significant, particularly in scenarios where OpenClaw is integrated into browser extensions or other browser-based applications.

Organizations and developers utilizing OpenClaw for automated browser testing, web scraping, or other browser control tasks are at risk. Specifically, those using OpenClaw in environments where users frequently browse untrusted websites or are susceptible to social engineering attacks are particularly vulnerable. Shared hosting environments where multiple applications share the same Node.js instance could also amplify the risk.

• nodejs: Monitor for unusual browser activity originating from external websites. Use ps aux | grep openclaw to identify running OpenClaw processes. Examine Node.js application logs for suspicious requests to OpenClaw endpoints. • generic web: Inspect browser developer tools network requests for unexpected POST requests to OpenClaw endpoints. Check browser extensions for potentially malicious code. • generic web: Review CSP headers to ensure they are properly configured to restrict cross-origin requests.

1. 2026-02-18Disclosure

   disclosure

1. Reserviert2026-02-13
2. Veröffentlicht2026-02-18
3. Geändert2026-02-20
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-26317 is to upgrade OpenClaw to version 2026.2.14 or later. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing stricter Origin/Referer validation on the mutation routes as a temporary workaround. This can be achieved by inspecting the request headers and rejecting requests from unauthorized origins. Additionally, implement robust input validation and sanitization to prevent unexpected behavior. After upgrading, confirm the fix by attempting to trigger a state change via a cross-origin request from a separate browser tab; the request should be rejected.