OpenClaw Vulnerability Enables Token Exfiltration and One-Click RCE via Malicious Link
A high-severity flaw in OpenClaw (also known as Clawdbot / Moltbot) enables one-click remote code execution (RCE) by abusing how the Control UI auto-connects to a gateway specified via a crafted URL. The issue is tracked as CVE-2026-25253 (CVSS 8.8) and was fixed in OpenClaw 2026.1.29; the core weakness is that the UI trusts gatewayUrl from the query string and sends a stored gateway token in the WebSocket connection payload, allowing token exfiltration to an attacker-controlled server.
With the stolen token, an attacker can connect to the victim’s local gateway and perform privileged actions—such as modifying configuration (e.g., sandbox/tool policies) and invoking privileged operations—resulting in full gateway compromise and RCE. Separate reporting also highlights architectural risk in OpenClaw’s local WebSocket-based Chrome orchestration, noting that (prior to patching) unauthenticated connections could be initiated from JavaScript running in a user’s browser, enabling cross-tab/session credential theft; users are advised to patch immediately and be cautious about deployment given ongoing security concerns.
Timeline
Feb 2, 2026
Security vendors and community urge users to patch OpenClaw
Following disclosure, security coverage from multiple sources warned that malicious websites could steal OpenClaw session credentials and lead to full system compromise. Users were advised to upgrade to version 2026.1.29, rotate tokens and secrets, and audit for suspicious WebSocket activity.
Feb 2, 2026
Technical details published for CVE-2026-25253 one-click RCE chain
Public reporting described how OpenClaw's Control UI trusted a gatewayUrl parameter, leaked an auth token over WebSocket, and allowed cross-site WebSocket hijacking because the server did not validate the Origin header. The disclosed attack chain showed how attackers could disable approvals, force host execution, and run arbitrary commands.
Jan 30, 2026
OpenClaw releases version 2026.1.29 to fix CVE-2026-25253
OpenClaw maintainer Peter Steinberger disclosed that the issue was fixed in OpenClaw version 2026.1.29, released on January 30, 2026. The patch addressed the flaw later tracked as CVE-2026-25253 affecting versions prior to 2026.1.29.
Jan 30, 2026
Researcher reports OpenClaw RCE flaw to maintainers
Security researcher Mav Levin of depthfirst reported a high-severity OpenClaw vulnerability that could lead to one-click remote code execution through authentication token exfiltration and WebSocket abuse.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Organizations
Sources
Related Stories
OpenClaw AI Assistant Local WebSocket Exposure Enables Browser Session Hijacking
A **critical vulnerability in the OpenClaw AI Assistant** (aka *Clawdbot*) allows a malicious website opened in the same browser session to connect to a locally exposed relay service and abuse the **Chrome DevTools Protocol (CDP)** to hijack browser sessions and steal credentials. Reporting indicates the extension starts a local server on `127.0.0.1:17892` and exposes WebSocket endpoints including `/cdp`; due to insufficient origin validation, attacker-controlled JavaScript can connect to `ws://127.0.0.1:17892/cdp`, enumerate tabs, and issue CDP commands (e.g., `Runtime.evaluate`) to extract cookies/session tokens or execute script in other tabs, impacting high-value services such as **Gmail** and **Microsoft 365**. Proof-of-concept code is publicly available and exploitation has been demonstrated, making the attack low-effort and high-impact for affected users. The issue has reportedly been **patched in the latest OpenClaw release**, and organizations using the extension should update immediately and assess exposure for potential session-token theft. Separate from OpenClaw, Plone CMS maintainers reported stopping a **supply-chain attempt** after an attacker used a stolen GitHub personal access token to force-push whitespace-obfuscated malicious code into multiple repositories; the changes were detected before any official release and were assessed as targeting developers rather than Plone site visitors.
1 months ago
OpenClaw (ClawdBot/Moltbot) One-Click Remote Code Execution via Unsafe Gateway URL Handling
A **critical one-click remote code execution (RCE)** issue was reported in *OpenClaw* (also referred to as **ClawdBot/Moltbot**), an open-source AI “agent” assistant that runs with high local privileges and access to sensitive data (e.g., messaging apps and API keys). The described exploit chain abuses **unsafe URL parameter ingestion** (e.g., a `gatewayUrl` query parameter accepted without validation), persistence of attacker-controlled values (stored in `localStorage`), and an **automatic gateway connection** that transmits an `authToken` during the handshake—enabling **cross-site WebSocket hijacking** and ultimately unauthenticated code execution after a victim clicks a single malicious link. Reporting indicates the flaw has been **weaponized**, making it a practical drive-by compromise path for endpoints running the assistant. Separate reporting highlighted broader concerns with agentic/open-source AI tooling and deployments, including the security risks of highly privileged “AI that acts for you” and the growing attack surface created by exposed AI services. Research cited large-scale internet exposure of open-source LLM runtimes (e.g., **Ollama**) with tool-calling and weak guardrails, warning that a single vulnerability or misconfiguration could enable widespread abuse (resource hijacking, identity laundering, or remote execution of privileged operations). These themes reinforce that AI agents and self-hosted AI stacks should be treated as **critical infrastructure**, with strict input validation, hardened update/connection flows, and strong monitoring around token handling and outbound connections.
1 months ago
OpenClaw AI Agent Exposures and One-Click RCE via WebSocket Hijacking
The open-source autonomous AI assistant **OpenClaw** (previously *Clawdbot* and *Moltbot*) is drawing security scrutiny after rapid adoption coincided with both widespread unsafe deployments and newly disclosed exploit chains. Reporting highlighted that the project’s autonomy-focused design (integrations with email, calendars, smart-home services, and other action-taking connectors) increases blast radius when misconfigured, and that security concerns have persisted through multiple rebrands as the ecosystem grows quickly. Internet scanning data indicated **21,000+ OpenClaw/Moltbot instances** were publicly exposed despite documentation recommending local-only access (default `TCP/18789`) and remote access via **SSH tunneling** rather than direct internet exposure; even where tokens are required for full access, exposed endpoints can aid adversary reconnaissance and targeting. Separately, researchers disclosed a **one-click RCE** chain leveraging **cross-site WebSocket hijacking** due to missing WebSocket `Origin` validation, enabling a malicious webpage to obtain an auth token, connect to the OpenClaw server, disable safety prompts/sandboxing, and invoke command execution (e.g., via `node.invoke`); the project issued a patch and advisory, while adjacent ecosystem components (e.g., agent-focused social features) were also flagged as adding additional attack surface.
2 days ago