OpenClawPublished 1 Feb 2026NVD status: Analyzed

CVE-2026-25253

OpenClaw: 1-click RCE via gateway token exfiltration from gatewayUrl

ComponentOpenClaw
Severityhigh (CVSS 8.8)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published (NVD)2026-02-01
Last modified2026-06-17
Affected versions
< 2026.1.29
from the GitHub-reviewed advisory GHSA-g8p2-7wf7-98mq
Fixed in2026.1.29
WeaknessCWE-669
CISA KEVnot listed

Versions, checked against NVD

NVD's analysis gives the same ranges as the GitHub-reviewed advisory GHSA-g8p2-7wf7-98mq.

What happened

The OpenClaw (then Clawdbot / Moltbot) Control UI read a gatewayUrl value from the query string and connected to it over WebSocket on page load, sending the stored gateway token without asking. A crafted link or a malicious page could send that token to an attacker, who could then connect to the victim's gateway, change sandbox and tool policies and run commands. It works even when the gateway only listens on loopback, because the victim's browser makes the outbound connection.

NVD description

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

What to do

  • Upgrade OpenClaw to 2026.1.29 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more