Openclaw cli: OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints (CVE-2026-26317)

OpenClaw CLI exposes browser control servers bound to loopback addresses with mutation endpoints that lack CSRF protections. Because browsers allow cross-origin requests to loopback addresses, a malicious website can exploit this by sending unauthorized state-changing requests (such as opening tabs or modifying storage) to the victim's local OpenClaw control plane. The vulnerability affects openclaw versions >=2026.1.29 and <2026.2.14 and clawdbot versions <=2026.1.24-3. The fix involves rejecting mutating HTTP methods (POST, PUT, PATCH, DELETE) if the request's Origin or Referer headers indicate a non-loopback source or if the Sec-Fetch-Site header signals a cross-site request. Additionally, enabling authentication on the control interface prevents exploitation.

An attacker controlling a malicious website can cause unauthorized state changes in a victim's local OpenClaw browser control plane by leveraging the lack of CSRF protections on loopback mutation endpoints. This can lead to actions such as opening or closing tabs, starting or stopping the browser, or modifying storage and cookies without the victim's consent. The impact is limited to local browser control plane access and requires the victim to visit a malicious site while OpenClaw is running with exposed loopback endpoints.

A patch is available that rejects mutating HTTP requests from non-loopback origins or cross-site contexts. Users should upgrade OpenClaw CLI to version 2026.2.14 or later once released. As an immediate mitigation, enabling authentication (token or password) on the browser control interface prevents unauthorized access and exploitation. Running OpenClaw with authentication disabled is not recommended.