A critical origin validation error in openclaw-dashboard exposes users to websocket hijacking, allowing attackers to perform unauthorized actions on behalf of the victim.

The vulnerability is an origin validation error (CWE-346) that enables cross site websocket hijacking. This allows an attacker to intercept or manipulate websocket communications by bypassing origin checks, which can be triggered when a user is tricked into interacting with a malicious site.

The CVSS score of 8.8 highlights the potential for full compromise of the dashboard interface. An attacker could gain unauthorized control over the system, leading to data exposure, unauthorized configuration changes, or the execution of administrative commands within the context of the user session.

Immediate Action: Update the openclaw-dashboard software to the latest version that includes the fix for origin validation, as referenced in the MeshCentral upstream commits.

Proactive Monitoring: Monitor web server logs for suspicious websocket connection requests and verify the origin headers associated with incoming traffic.

Compensating Controls: Use a Web Application Firewall (WAF) configured to validate origin headers and block connections that do not match the expected source domain.

Public Exploit Available: Unknown.

Given the potential for complete dashboard compromise, organizations should prioritize the update of this component. Ensure that any web-based management interfaces are not exposed to the public internet without proper origin validation and session security controls.