OpenClaw 受跨站请求伪造 (CSRF) 影响，通过 loopback 浏览器突变端点实现

该CSRF漏洞允许攻击者通过恶意网站，在受害者的本地OpenClaw浏览器控制平面上发起未经授权的操作。攻击者可以利用此漏洞打开新的浏览器标签页、启动或停止浏览器进程，甚至修改存储和Cookie等数据。虽然loopback绑定降低了远程暴露的风险，但并不能完全阻止浏览器发起的恶意请求。如果攻击者能够控制受害者的浏览器上下文，则可能造成严重的安全影响，例如窃取敏感信息或执行恶意代码。

Organizations and developers utilizing OpenClaw for automated browser testing, web scraping, or other browser control tasks are at risk. Specifically, those using OpenClaw in environments where users frequently browse untrusted websites or are susceptible to social engineering attacks are particularly vulnerable. Shared hosting environments where multiple applications share the same Node.js instance could also amplify the risk.

• nodejs: Monitor for unusual browser activity originating from external websites. Use ps aux | grep openclaw to identify running OpenClaw processes. Examine Node.js application logs for suspicious requests to OpenClaw endpoints. • generic web: Inspect browser developer tools network requests for unexpected POST requests to OpenClaw endpoints. Check browser extensions for potentially malicious code. • generic web: Review CSP headers to ensure they are properly configured to restrict cross-origin requests.

1. 2026-02-18Disclosure

   disclosure

1. 已保留2026-02-13
2. 发布日期2026-02-18
3. 修改日期2026-02-20
4. EPSS 更新日期2026-03-23

修复此漏洞的首要措施是升级到openclaw 2026.2.14或更高版本。如果无法立即升级，可以考虑使用Web应用防火墙(WAF)或代理服务器来过滤恶意请求，并实施严格的Origin/Referer验证。此外，应审查OpenClaw的配置，确保其只允许来自受信任来源的请求。升级后，请验证漏洞是否已成功修复，例如通过尝试触发CSRF攻击，确认其已被阻止。