OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script …

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting (XSS) vulnerability tracked as CVE-2026-66418. Unauthenticated remote attackers can inject arbitrary HTML and JavaScript by submitting a crafted username in a failed login POST request. The malicious input is recorded verbatim in the audit log without sanitization. When an administrator views the notification panel, the unescaped log entry is rendered via innerHTML. A permissive Content-Security-Policy allows inline event handlers, enabling the payload to execute in the administrator's browser session. This can allow attackers to interact with authenticated endpoints, edit agent instruction files, and make configuration changes, effectively leading to administrator account takeover.