CVE-2026-25253
📋 TL;DR
OpenClaw (also known as clawdbot or Moltbot) versions before 2026.1.29 automatically establish WebSocket connections using gatewayUrl values from query strings without user consent, transmitting authentication tokens. This allows attackers to execute remote code and steal sensitive data. Users of vulnerable OpenClaw installations are affected.
💻 Affected Systems
- OpenClaw
- clawdbot
- Moltbot
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution leading to data theft, credential harvesting, and lateral movement within the network.
Likely Case
Unauthorized access to sensitive Moltbot data and cryptographic keys, potentially enabling account takeover and data exfiltration.
If Mitigated
Limited impact with proper network segmentation and access controls, though token exposure remains a concern.
🎯 Exploit Status
Exploitation requires only a crafted URL that victims click, making this a one-click attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.1.29
Vendor Advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq
Restart Required: Yes
Instructions:
1. Update OpenClaw to version 2026.1.29 or later. 2. Restart the OpenClaw service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable automatic WebSocket connections
allModify configuration to require user confirmation before establishing WebSocket connections from query parameters.
# Configuration change depends on specific deployment
Network isolation
allRestrict network access to OpenClaw instances to prevent external exploitation.
# Use firewall rules to limit inbound connections
🧯 If You Can't Patch
- Isolate OpenClaw instances in a restricted network segment with no internet access
- Implement strict input validation and sanitization for all query parameters
🔍 How to Verify
Check if Vulnerable:
Check if OpenClaw version is earlier than 2026.1.29 and if it automatically establishes WebSocket connections from query strings.Check Version:
openclaw --version or check package managerVerify Fix Applied:
Confirm OpenClaw version is 2026.1.29 or later and test that WebSocket connections require user confirmation.📡 Detection & Monitoring
Log Indicators:
- Unexpected WebSocket connection attempts
- Suspicious query parameters containing gatewayUrl values
- Unauthorized token transmissions
Network Indicators:
- Unusual WebSocket traffic to external domains
- Outbound connections initiated without user interaction
SIEM Query:
source="openclaw" AND (event="websocket_connection" OR query_string="*gatewayUrl*")🔗 References
- https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys
- https://ethiack.com/news/blog/one-click-rce-moltbot
- https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq
- https://openclaw.ai/blog
- https://x.com/0xacb/status/2016913750557651228
- https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys