Openclaw CVE-2026-25253
HIGH
GHSA-g8p2-7wf7-98mq
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
AnalysisAI
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs extracted from query strings, transmitting authentication tokens without user confirmation. This network-based vulnerability requires user interaction (clicking a malicious link) and allows attackers to hijack authenticated sessions and perform actions with the victim's privileges. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all OpenClaw deployments and identify version numbers; isolate affected systems from production if business continuity permits. Within 7 days: Implement network segmentation to restrict outbound WebSocket connections to known, whitelisted gateway endpoints only; enable detailed logging of all WebSocket connection attempts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today