Skip to content
OpenAdvisories

Product · OpenClaw

clawdbot

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-26317

    OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

    OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiate…

    OpenClaw OpenClaw clawdbot openclaw npm