CVE-2026-66418

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard version 3.0.0

Description A stored cross-site scripting issue exists where unauthenticated remote attackers can inject arbitrary HTML and script payloads. This occurs when a crafted username is submitted in a failed login POST request, which is then recorded verbatim in the audit log. When an administrator opens the notification panel, the log entry is rendered using innerHTML. Due to a permissive Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks) that allows inline event handlers, the payload executes within the administrator's session. This allows the attacker to interact with authenticated endpoints, such as editing agent instruction files and modifying configurations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.