Cross-Origin Request Vulnerability in OpenClaw Personal AI Assistant

CVE-2026-26317

What is CVE-2026-26317?

OpenClaw, a personal AI assistant, contains a vulnerability that allows cross-origin browser requests on localhost mutation routes without proper Origin/Referer validation. This weakness enables attackers to exploit browser capabilities and perform unauthorized actions within the user's local OpenClaw environment. Threat actors can potentially alter states such as opening new tabs, controlling the browser, and manipulating storage and cookies by issuing malicious requests from the browser context. The flaw is mitigated in version 2026.2.14 with enhanced restrictions on mutating HTTP methods to ensure they are only accepted if the request comes from a loopback origin. Users are advised to enable authentication for browser control and avoid using the assistant without proper security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References