---
title: "OpenClaw CVE-2026-25253: One-Click RCE via Token Leak"
url: https://erroneo.us/security/briefs/openclaw-one-click-rce-gatewayurl-token/
description: "OpenClaw (Clawdbot/Moltbot) before 2026.1.29 leaks its gateway token to any link, enabling host RCE even on localhost. Update and rotate tokens."
type: security-brief
section: "Security Digest"
date_published: 2026-01-31
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-25253"]
severity: "high"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# OpenClaw CVE-2026-25253: One-Click RCE via Token Leak

**Verdict: Patch this week.** Fixed since January, but any OpenClaw install that missed updates can be taken over by its owner clicking one link, and a loopback-only setup does not save it.

- **Who must act:** Anyone running an OpenClaw/Clawdbot/Moltbot gateway older than 2026.1.29, including on a laptop bound to localhost.
- **Who can relax:** Users already on 2026.1.29 or later who have rotated their gateway token since; people who never ran OpenClaw.
- **Affected:** OpenClaw / clawdbot npm package v2026.1.28 and earlier
- **Fixed:** OpenClaw v2026.1.29 (released Jan 30, 2026)
- **CVEs:** CVE-2026-25253
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Check your version (openclaw --version or the Control UI) and update to 2026.1.29 or later
2. Rotate the gateway auth token after updating
3. Review exec approval settings and confirm tools.exec.host still points at the sandbox, not the gateway host
4. Do not expose the gateway port (default 18789) to the internet; put remote access behind a VPN or authenticated tunnel
5. Rotate API keys, OAuth tokens and chat-platform credentials the agent held if you ran a vulnerable version and clicked untrusted links

### How to check if you are affected

- Look in the OpenClaw config for exec approvals set to ask: off or tools.exec.host set to gateway that you did not change
- Check the gateway's session/connection history for clients from unfamiliar IPs or origins
- Review shell history and process logs on the host for commands launched via node.invoke/system.run that you did not request

## What happened

On January 31, 2026, OpenClaw maintainer Peter Steinberger published [GHSA-g8p2-7wf7-98mq](https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq). OpenClaw is the open-source personal AI agent, formerly Clawdbot and Moltbot, that runs on your own machine and can execute shell commands for you. The advisory, assigned [CVE-2026-25253](https://www.cve.org/CVERecord?id=CVE-2026-25253) (CVSS 8.8), describes a one-click path from a web link to code execution on the host.

The OpenClaw Control UI accepted a `gatewayUrl` query-string parameter without validation, connected to it automatically on page load, and sent the stored gateway token in the WebSocket handshake. [depthfirst's write-up](https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys) by Mav Levin shows the full chain:

1. The victim opens a crafted link.
2. The token goes to the attacker's server.
3. Because the gateway did not check the WebSocket `Origin` header, the attacker's page uses the victim's browser to connect to `ws://localhost:18789` (cross-site WebSocket hijacking).
4. With the token's `operator.admin` and `operator.approvals` scopes, the attacker turns exec approvals off.
5. The attacker moves command execution from the container sandbox to the gateway host.
6. The attacker runs a shell command through `node.invoke`.

Levin told [The Hacker News](https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html) that this takes milliseconds after a single page visit.

## Who is affected

The advisory covers the `clawdbot`/OpenClaw package v2026.1.28 and earlier. The fix, v2026.1.29, was released January 30, 2026, and makes the UI ask the user to confirm a new gateway URL instead of auto-connecting. The advisory says any deployment where a user has authenticated to the Control UI is affected. It also says this "works even when the gateway listens only on loopback," because the victim's browser makes the connection.

The exposure was large. The Hacker News noted the GitHub repository had passed 149,000 stars only weeks after the project's November 2025 release. Third-party scans of internet-exposed instances reported widely varying counts, which we could not verify, so we do not repeat them here.

## Do you really need to act?

The patch is almost nine months old. If you auto-update or installed OpenClaw recently, you are fine. The worry is stale installs: a hobby box set up in January and left alone, or a pinned container image.

The precondition is low. The victim only has to click a link or land on a page that redirects to one, and the payoff is a shell with whatever the agent can reach, usually email, chat accounts, files and API keys. depthfirst published the full exploit chain, so a working proof of concept is public. None of the sources we reviewed confirm in-the-wild exploitation, and CVE-2026-25253 is not in [CISA KEV](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) as of October 21, 2026.

Because the stolen token stays valid after you patch, updating without rotating the token leaves you exposed.

## What to do now

1. Confirm your version in the Control UI or with the CLI, and update to 2026.1.29 or later. Running the current release is better than stopping at the minimum fixed version.
2. Rotate the gateway token after updating.
3. Re-check the safety settings: exec approvals should be on, and `tools.exec.host` should point at the sandbox.
4. Never publish port 18789 to the internet. For remote use, put it behind a VPN or an authenticated tunnel.
5. If you ran a vulnerable build and browse the web on the same machine, rotate the credentials the agent holds: model API keys, messaging bot tokens and OAuth grants.

## How to tell if you were hit

Look for these signs:

- Configuration changes you did not make: approvals switched to "off," or exec moved to "gateway."
- Gateway connections from unfamiliar IPs.
- Commands in shell history or process accounting that came from the agent but match no request of yours.

Also check the accounts the agent controls (mail, Slack, Telegram, cloud) for sessions or actions you do not recognize.

## Timeline

- Jan 30, 2026: OpenClaw 2026.1.29 released with the fix.
- Jan 31, 2026: GHSA-g8p2-7wf7-98mq published.
- Feb 1, 2026: CVE-2026-25253 published; depthfirst publishes the exploit chain.
- Oct 21, 2026: Not in CISA KEV; public PoC available.

## Sources

1. [OpenClaw (GitHub) — GHSA-g8p2-7wf7-98mq: 1-Click RCE via authentication token exfiltration from gatewayUrl](https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq)
2. [CVE.org — CVE-2026-25253 record](https://www.cve.org/CVERecord?id=CVE-2026-25253)
3. [depthfirst — 1-Click RCE to steal your Moltbot data and keys](https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys)
4. [CISA — Known Exploited Vulnerabilities catalog (JSON feed, checked 2026-10-21)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
5. [The Hacker News — OpenClaw bug enables one-click remote code execution via malicious link](https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html)

---
Source page: https://erroneo.us/security/briefs/openclaw-one-click-rce-gatewayurl-token/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt