OpenClaw is a personal AI assistant that exposed a set of browser‑facing localhost endpoints for mutating state without validating the Origin or Referer headers. The missing check allowed a malicious website to cause the victim’s browser to perform unauthorized actions—such as opening or closing tabs, altering storage or cookies, or starting and stopping the OpenClaw instance—by sending requests to the loopback interface. Based on the description, it is inferred that an attacker would need only to host a malicious page that the victim visits, and the victim’s browser would then forge the requests. The flaw maps to the classic cross‑site request forgery weakness (CWE‑352), and the primary impact is local state manipulation that can disrupt the user’s browsing experience.

The vulnerability affects all releases of OpenClaw and its ClawDBot component that are older than version 2026.2.14. Users with the browser‑control REST API bound to the loopback interface and authentication disabled are exposed. No finer version granularity is provided beyond the cutoff, so it should be presumed that every pre‑2026.2.14 build is potentially affected.

The CVSS score of 7.1 indicates a high impact with moderate to high exploitability. The EPSS score of < 1 % suggests that exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Attackers would need only a malicious web page; the victim’s browser would then forge requests to the loopback mutation endpoints, bypassing the lack of Origin/Referer validation. The combination of low EPSS and high CVSS underscores the importance of promptly applying the vendor’s patch or enabling authentication.