CVE-2026-66418 is a stored cross-site scripting vulnerability in OpenClaw Dashboard v3.0.0. The vulnerability arises because the application records the username from failed login attempts verbatim in the audit log without proper input neutralization. The audit log entries are rendered in the administrator's notification panel using innerHTML, combined with a Content-Security-Policy that permits inline event handlers, allowing execution of injected scripts. This flaw enables unauthenticated remote attackers to execute arbitrary HTML and JavaScript in the context of an administrator's session, potentially leading to unauthorized administrative actions.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the administrator's browser session. This can lead to unauthorized interaction with sensitive administrative endpoints, including editing agent instruction files and modifying configuration settings. The vulnerability poses a critical risk to the confidentiality, integrity, and availability of the system managed via the OpenClaw Dashboard.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid opening the notification panel or viewing audit logs that may contain untrusted input. Implementing additional input validation and output encoding on usernames and audit log entries can mitigate the risk. Review and tighten Content-Security-Policy settings to disallow inline event handlers.