OpenClaw Dashboard v3.0.0 Stored XSS Vulnerability: Early Warning
An early warning has been issued regarding a critical stored cross-site scripting vulnerability in OpenClaw Dashboard v3.0.0, which reportedly allows unauthenticated remote attackers to inject arbitrary HTML and script payloads.
What happened
OpenClaw Dashboard v3.0.0 is under investigation for containing a stored cross-site scripting vulnerability, tracked as CVE-2026-66418 and CVE-2026-66421, both rated CRITICAL with a CVSS score of 9.3. This vulnerability appears to allow unauthenticated remote attackers to inject arbitrary HTML and script payloads. When an administrator opens the notification panel or views agent transcript messages, the unescaped log entry or message is rendered, enabling the attacker-supplied payload to execute in the administrator's session. This could potentially allow unauthorized access to authenticated endpoints, including agent instruction file editing and configuration changes.
To assess your exposure, check if your environment utilizes OpenClaw Dashboard v3.0.0. It is recommended to monitor for updates from the OpenClaw project regarding patched versions. For the most accurate and up-to-date information, consult the primary sources linked in the NVD entries for CVE-2026-66418 and CVE-2026-66421.
How 0Day mitigates this
openclaw-dashboard is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.