CVE-2026-66421

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute within the 60-character rendering budget, which is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page, allowing theft of session tokens and unauthorized calls to authenticated administrative endpoints including agent instruction file modification.

• CWE-79

• https://github.com/theopaid/Stored-Cross-Site-Scripting-Via-Agent-Messages-Leading-To-Session-Token-Theft-openclaw-dashboard-Exploit, Mitigation, Third Party Advisory
• https://github.com/tugcantopaloglu/openclaw-dashboardProduct
• https://www.vulncheck.com/advisories/openclaw-dashboard-stored-xss-via-lastmessage-session-fieldExploit, Third Party Advisory
• https://github.com/theopaid/Stored-Cross-Site-Scripting-Via-Agent-Messages-Leading-To-Session-Token-Theft-openclaw-dashboard-Exploit, Mitigation, Third Party Advisory

Published

Jul 30, 2026

Last Modified

Sep 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66414Leantime 3.6.2 contains an open redirect vulnerability in th…6.1
• CVE-2026-66415Leantime 3.6.2 contains a server-side request forgery and lo…8.5
• CVE-2026-66416Leantime 3.6.2 contains a cross-site request forgery vulnera…8.8
• CVE-2026-66418OpenClaw Dashboard v3.0.0 contains a stored cross-site scrip…9.3
• CVE-2026-6642The Media Library Assistant plugin for WordPress is vulnerab…6.4
• CVE-2026-66420MeshCentral 1.1.21 contains a cross-site WebSocket hijacking…8.8
• CVE-2026-66422Improper Authorization vulnerability in Apache Tomcat cause …8.1
• CVE-2026-66424Unauthenticated Privilege Escalation in SMS Alert Order Noti…9.8
• CVE-2026-66425Unauthenticated Broken Authentication in Gutena Forms – Cont…6.5
• CVE-2026-66426Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.…7.1
• CVE-2026-66427Administrator SQL Injection in WP Google Review Slider <= 18…7.6
• CVE-2026-66428Unauthenticated Cross Site Request Forgery (CSRF) in WP Goog…4.3