7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26317

CVE-2026-26317: OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins. A malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane (for example opening tabs, starting/stopping the browser, mutating storage/cookies) if the browser control service is reachable on loopback in the victim's browser context. Starting in version 2026.2.14, mutating HTTP methods (POST/PUT/PATCH/DELETE) are rejected when the request indicates a non-loopback Origin/Referer (or Sec-Fetch-Site: cross-site). Other mitigations include enabling browser control auth (token/password) and avoid running with auth disabled.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26317

CVE-2026-26317:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14
clawdbot	npm	<= 2026.1.24-3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) weakness in OpenClaw's browser control servers. These servers, which listen on loopback addresses (localhost), did not validate the 'Origin' or 'Referer' headers of incoming HTTP requests. This allowed a malicious website visited by a user to send requests to the local OpenClaw instance and perform unauthorized actions, such as opening tabs or modifying storage.

The patch introduces a middleware, browserMutationGuardMiddleware, which is now applied to the Express.js applications created in startBrowserBridgeServer and startBrowserControlServerFromConfig. This middleware inspects incoming requests for mutating HTTP methods (POST, PUT, PATCH, DELETE). If such a request is detected, it checks if it's a cross-origin request by examining the Origin, Referer, and Sec-Fetch-Site headers. If the request is identified as cross-origin, it is rejected with a 403 Forbidden status.

The vulnerable functions are the ones responsible for setting up these servers without the necessary CSRF protection. By adding the middleware, the patch secures these server setup functions, making them no longer vulnerable.

Vulnerable functions

startBrowserBridgeServer

src/browser/bridge-server.ts

This function initializes an Express.js server for the browser bridge. Prior to the patch, this server did not have CSRF (Cross-Site Request Forgery) protection, allowing any website to send requests and perform state-changing actions. The patch adds the `browserMutationGuardMiddleware` to validate incoming requests and block those from unauthorized origins, thus mitigating the vulnerability.

startBrowserControlServerFromConfig

src/browser/server.ts

This function sets up the main browser control server. It was vulnerable to CSRF because it lacked checks to ensure that mutating requests (like POST, PUT, DELETE) originated from a trusted, loopback source. An attacker could craft a malicious webpage to send requests to this server and execute arbitrary actions. The fix was to add the `browserMutationGuardMiddleware` to reject such cross-origin requests.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.