CVE-2026-25253

OpenClaw (also distributed under the names clawdbot and Moltbot) before version 2026.1.29 accepts a gatewayUrl value from a query string and automatically opens a WebSocket connection to it without prompting the user, sending the instance's token to that endpoint (CWE-669, incorrect resource transfer between spheres). An attacker triggers the flaw by getting a user to open a crafted link, at which point the gateway token is handed to an attacker-controlled WebSocket server. Possession of the token allows the attacker to connect to the victim's gateway, execute commands, and steal data and API keys, achieving one-click remote code execution as demonstrated in public proofs of concept. Any user or operator running an OpenClaw/Moltbot/clawdbot release earlier than 2026.1.29 is affected. No in-the-wild exploitation is confirmed and the flaw is not yet in CISA KEV, but a 24% EPSS score (98th percentile) and three published PoC references indicate a high likelihood of near-term exploitation.

What to do: Upgrade to OpenClaw 2026.1.29 or later. Until upgraded, treat inbound chat links as untrusted and avoid opening them while the gateway is running, and rotate the gateway token plus any connected API keys if a crafted link may have been opened. Check gateway logs for unexpected outbound WebSocket connections to unfamiliar hosts.