CVE-2026-66418 Details

A stored cross-site scripting vulnerability has been identified in OpenClaw Dashboard version 3.0.0. This vulnerability allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request. The injected payload is recorded verbatim in the audit log. When an administrator accesses the notification panel, the unescaped log entry is rendered using innerHTML, facilitated by a permissive Content-Security-Policy that allows inline event handlers. This enables the execution of the attacker-supplied payload in the administrator's session, with the ability to interact with authenticated endpoints, including editing agent instruction files and making configuration changes.

To address this vulnerability, OpenClaw Dashboard should be updated to a version that fixes the cross-site scripting issue. Additionally, implement input validation for the username field to restrict the length and character set before logging failed login attempts.