CVE-2026-26317: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-26317 is a Cross-Site Request Forgery (CSRF) vulnerability in OpenClaw, a personal AI assistant, affecting its browser-facing localhost mutation routes. Prior to version 2026.2.14, the browser control plane accepted cross-origin requests without validating the Origin or Referer headers, allowing malicious websites to trigger unauthorized state changes against a victim's local OpenClaw instance. The vulnerability affects the openclaw npm package versions ≤ 2026.2.13 and the clawdbot npm package versions ≤ 2026.1.24-3. It was published on February 15, 2026, and added to the GitHub Advisory Database on February 18, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): the browser control servers bound to loopback but exposed mutating HTTP endpoints (POST/PUT/PATCH/DELETE) without any CSRF-style guard, relying solely on loopback binding for protection (GitHub Advisory). Browsers can send cross-origin requests to loopback addresses, so a malicious website can craft requests targeting localhost or 127.0.0.1 on the port used by OpenClaw's browser control service. The attack requires the victim to visit a malicious web page while OpenClaw is running, and no authentication credentials or special privileges are needed if the service runs without auth enabled. The fix introduced a browserMutationGuardMiddleware that inspects Origin, Referer, and Sec-Fetch-Site: cross-site headers, rejecting mutating requests from non-loopback origins (Fix Commit).

A malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane, including opening or closing browser tabs, starting or stopping the browser, and mutating browser storage and cookies — all without requiring any special privileges from the attacker (GitHub Advisory). The primary impact is on integrity (unauthorized modification of browser state) and availability (potential disruption of the browser session); there is no direct confidentiality impact as data exfiltration is not a documented consequence. The attack is limited to the local machine context but could be leveraged to manipulate the victim's browsing environment or AI assistant behavior.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.014% (0.000140), placing it in the 6th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires user interaction — the victim must visit a malicious website while running a vulnerable version of OpenClaw with the browser control service active and authentication disabled.

1. Reconnaissance: Identify a target running a vulnerable version of OpenClaw (npm openclaw ≤ 2026.2.13 or clawdbot ≤ 2026.1.24-3) with the browser control service active on loopback (e.g., http://127.0.0.1:18789) and authentication disabled.
2. Craft malicious page: Create a web page that, when visited by the victim, automatically sends cross-origin HTTP requests (e.g., via fetch() or XMLHttpRequest) to the OpenClaw loopback browser control endpoint using a mutating method such as POST.
3. Trigger CSRF request: When the victim visits the malicious page, the browser sends a POST request to http://127.0.0.1:<port>/<mutation-endpoint> with a non-loopback Origin header (e.g., https://evil.example). The vulnerable server, lacking Origin/Referer validation, processes the request.
4. Achieve unauthorized state change: The server executes the requested action — such as opening a new browser tab, stopping the browser, or modifying cookies/storage — on behalf of the attacker without the victim's consent (GitHub Advisory, Fix Commit).

• Network: Unexpected HTTP POST/PUT/PATCH/DELETE requests to http://127.0.0.1:<openclaw-port>/ originating from browser processes with a non-loopback Origin or Referer header (e.g., Origin: https://evil.example).
• Logs: OpenClaw server logs showing mutating HTTP requests from cross-origin sources without authentication tokens; browser network logs showing requests to loopback addresses initiated by third-party web pages.
• Process/Browser Behavior: Unexplained browser tab openings or closings, unexpected browser restarts, or unexplained changes to browser cookies/storage while OpenClaw is running.
• File System: Unexpected modifications to OpenClaw-managed browser storage or cookie files correlating with visits to unknown external websites.

Upgrade the openclaw npm package to version 2026.2.14 or later, which introduces browserMutationGuardMiddleware to reject mutating HTTP methods from non-loopback origins (GitHub Release, Fix Commit). Note that the clawdbot npm package (≤ 2026.1.24-3) does not yet have a patched version listed. As an interim workaround, enable browser control authentication (token or password) to require credentials for all control plane requests, and avoid running OpenClaw with authentication disabled. If the browser control service is not needed, disable it entirely when not in use (GitHub Advisory).

The vulnerability was reported by researcher @vincentkoc and disclosed by maintainer steipete on February 15, 2026 (GitHub Advisory). Coverage appeared in vulnerability digest aggregators and security blogs, including a Stackademic post grouping CVE-2026-26317 with related OpenClaw vulnerabilities CVE-2026-26323 and CVE-2026-26327 as part of a broader "2026 OpenClaw vulnerability cluster." BeyondMachines noted that over 60 security vulnerabilities were resolved in OpenClaw around this release. The release of version 2026.2.14 received positive community reactions on GitHub, with 137 users reacting to the release notes (GitHub Release).