Critical 9.3Published Jul 30, 2026

CVE-2026-66421OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injectin…

Updated under an hour ago (2026-10-19 07:30 UTC)

Does this affect you?

It affects tugcantopaloglu openclaw_agent_dashboard. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for tugcantopaloglu openclaw_agent_dashboard

Exploited in the last 30 days

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute within the 60-character rendering budget, which is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page, allowing theft of session tokens and unauthorized calls to authenticated administrative endpoints including agent instruction file modification.

CVSS: 9.3 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Sep 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

tugcantopaloglu openclaw_agent_dashboard tugcantopaloglu:openclaw_agent_dashboard	through 1.1.0	NVD

References

https://github.com/theopaid/Stored-Cross-Site-Scripting-Via-Agent-Messages-Leading-To-Session-Token-Theft-openclaw-dashboard-exploit, mitigation, third-party-advisory
https://github.com/tugcantopaloglu/openclaw-dashboardproduct
https://www.vulncheck.com/advisories/openclaw-dashboard-stored-xss-via-lastmessage-session-fieldexploit, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.