OpenClaw CVE-2026-25253: One-Click RCE via Token Leak

What to do

1. Check your version (openclaw --version or the Control UI) and update to 2026.1.29 or later
2. Rotate the gateway auth token after updating
3. Review exec approval settings and confirm tools.exec.host still points at the sandbox, not the gateway host
4. Do not expose the gateway port (default 18789) to the internet; put remote access behind a VPN or authenticated tunnel
5. Rotate API keys, OAuth tokens and chat-platform credentials the agent held if you ran a vulnerable version and clicked untrusted links

How to check if you are affected or compromised

• Look in the OpenClaw config for exec approvals set to ask: off or tools.exec.host set to gateway that you did not change
• Check the gateway's session/connection history for clients from unfamiliar IPs or origins
• Review shell history and process logs on the host for commands launched via node.invoke/system.run that you did not request

What happened#

On January 31, 2026, OpenClaw maintainer Peter Steinberger published GHSA-g8p2-7wf7-98mq. OpenClaw is the open-source personal AI agent, formerly Clawdbot and Moltbot, that runs on your own machine and can execute shell commands for you. The advisory, assigned CVE-2026-25253 (CVSS 8.8), describes a one-click path from a web link to code execution on the host.

The OpenClaw Control UI accepted a gatewayUrl query-string parameter without validation, connected to it automatically on page load, and sent the stored gateway token in the WebSocket handshake. depthfirst's write-up by Mav Levin shows the full chain:

1. The victim opens a crafted link.
2. The token goes to the attacker's server.
3. Because the gateway did not check the WebSocket Origin header, the attacker's page uses the victim's browser to connect to ws://localhost:18789 (cross-site WebSocket hijacking).
4. With the token's operator.admin and operator.approvals scopes, the attacker turns exec approvals off.
5. The attacker moves command execution from the container sandbox to the gateway host.
6. The attacker runs a shell command through node.invoke.

Levin told The Hacker News that this takes milliseconds after a single page visit.

Who is affected#

The advisory covers the clawdbot/OpenClaw package v2026.1.28 and earlier. The fix, v2026.1.29, was released January 30, 2026, and makes the UI ask the user to confirm a new gateway URL instead of auto-connecting. The advisory says any deployment where a user has authenticated to the Control UI is affected. It also says this "works even when the gateway listens only on loopback," because the victim's browser makes the connection.

The exposure was large. The Hacker News noted the GitHub repository had passed 149,000 stars only weeks after the project's November 2025 release. Third-party scans of internet-exposed instances reported widely varying counts, which we could not verify, so we do not repeat them here.

Do you really need to act?#

The patch is almost nine months old. If you auto-update or installed OpenClaw recently, you are fine. The worry is stale installs: a hobby box set up in January and left alone, or a pinned container image.

The precondition is low. The victim only has to click a link or land on a page that redirects to one, and the payoff is a shell with whatever the agent can reach, usually email, chat accounts, files and API keys. depthfirst published the full exploit chain, so a working proof of concept is public. None of the sources we reviewed confirm in-the-wild exploitation, and CVE-2026-25253 is not in CISA KEV as of October 21, 2026.

Because the stolen token stays valid after you patch, updating without rotating the token leaves you exposed.

What to do now#

1. Confirm your version in the Control UI or with the CLI, and update to 2026.1.29 or later. Running the current release is better than stopping at the minimum fixed version.
2. Rotate the gateway token after updating.
3. Re-check the safety settings: exec approvals should be on, and tools.exec.host should point at the sandbox.
4. Never publish port 18789 to the internet. For remote use, put it behind a VPN or an authenticated tunnel.
5. If you ran a vulnerable build and browse the web on the same machine, rotate the credentials the agent holds: model API keys, messaging bot tokens and OAuth grants.

How to tell if you were hit#

Look for these signs:

• Configuration changes you did not make: approvals switched to "off," or exec moved to "gateway."
• Gateway connections from unfamiliar IPs.
• Commands in shell history or process accounting that came from the agent but match no request of yours.

Also check the accounts the agent controls (mail, Slack, Telegram, cloud) for sessions or actions you do not recognize.

Timeline#

• Jan 30, 2026: OpenClaw 2026.1.29 released with the fix.
• Jan 31, 2026: GHSA-g8p2-7wf7-98mq published.
• Feb 1, 2026: CVE-2026-25253 published; depthfirst publishes the exploit chain.
• Oct 21, 2026: Not in CISA KEV; public PoC available.

Vulnerability records

• CVE-2026-25253 · OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. OpenClaw (GitHub) — GHSA-g8p2-7wf7-98mq: 1-Click RCE via authentication token exfiltration from gatewayUrl github.com
2. CVE.org — CVE-2026-25253 record cve.org
3. depthfirst — 1-Click RCE to steal your Moltbot data and keys depthfirst.com
4. CISA — Known Exploited Vulnerabilities catalog (JSON feed, checked 2026-10-21) cisa.gov

Coverage and analysis

1. The Hacker News — OpenClaw bug enables one-click remote code execution via malicious link thehackernews.com