Is CVE-2026-26317 actively exploited?

No active exploitation of CVE-2026-26317 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26317 be exploited remotely?

Yes. CVE-2026-26317 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26317?

CVE-2026-26317 has a CVSS score of 7.1 (HIGH) and an EPSS exploitation probability of 0.01%.

HOME VULNERABILITIESCVE-2026-26317

HIGH

CVE-2026-26317

CWE-352Published: February 19, 2026· Updated: Feb 26, 2026

7.1

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.6th

Official Description

OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins. A malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane (for example opening tabs, starting/stopping the browser, mutating storage/cookies) if the browser control service is reachable on loopback in the victim's browser context. Starting in version 2026.2.14, mutating HTTP methods (POST/PUT/PATCH/DELETE) are rejected when the request indicates a non-loopback Origin/Referer (or `Sec-Fetch-Site: cross-site`). Other mitigations include enabling browser control auth (token/password) and avoid running with auth disabled.

NVD Source

Technical Analysis

CVE-2026-26317 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.1.