Attackers exploit this by injecting HTML markup containing event handler payloads, such as an <img> tag with an onerror attribute, into the transcript messages. These payloads are subsequently rendered by the OpenClaw Dashboard's default landing page through the use of innerHTML. The injection allows for the theft of administrative session tokens and the execution of unauthorized actions, including the modification of agent instruction files. Given the impact on administrative session integrity and authorization controls, this vulnerability poses a critical risk to organizations relying on OpenClaw Dashboard for infrastructure management.

Impact

Successful exploitation allows for complete compromise of an administrator's session. Potential consequences include the theft of sensitive session identifiers, unauthorized access to administrative dashboard functions, and the ability to modify critical agent instruction files, which could lead to further downstream system compromise or data exfiltration.

Recommendation

• Prioritize patching OpenClaw Dashboard to the latest version provided by the vendor to remediate CVE-2026-66421.
• Audit web server logs for HTTP requests to the sessions API that contain suspicious HTML tags or event handlers, such as onerror, onload, or script.
• Restrict access to the OpenClaw Dashboard administrative interface to trusted management networks to minimize the exposure to unauthenticated external actors.