OpenClaw

OpenClaw before 2026.1.29 trusts a user-controlled gatewayUrl in the Control UI query string and auto-connects to it, sending the stored gateway token during the WebSocket handshake. Per the vendor advisory and NVD, affected versions are <= 2026.1.28, fixed in 2026.1.29. The practical result is token exfiltration and then operator-level control of the OpenClaw gateway API, which can be turned into command execution because OpenClaw is built to read files, run commands, and manipulate integrations.

The vendor's 8.8 HIGH is basically fair, but not because this is broad unauthenticated internet RCE in the classic sense. The real risk amplifier is that *localhost is not a defense here* once a logged-in user loads attacker content; the real friction is that the attacker still needs both user interaction and an authenticated OpenClaw UI session. That keeps it out of CRITICAL, but the post-click blast radius on a compromised operator workstation is bad enough to keep it firmly HIGH.

Why this verdict

• Keeps vendor baseline mostly intact: token theft becomes gateway takeover, and gateway takeover in OpenClaw is practically code execution because the product is built for command execution and secret access.
• One-click but not zero-click: the attacker needs a victim to load malicious content *and* that victim needs an authenticated Control UI session. That is a meaningful real-world friction point, so I shave the score below the vendor's 8.8.
• Local-only deployments are still exposed: GHSA and the depthfirst write-up both make clear that loopback binding does not neutralize this issue, because the browser becomes the network pivot.
• Population is narrower than mainstream enterprise software: OpenClaw is noisy and risky where deployed, but this is not Windows, Chrome, Exchange, or a top-edge device class. Product prevalence limits enterprise-wide systemic urgency.
• Exposure numbers are still ugly: Censys and Bitsight both found tens of thousands of exposed instances, which prevents a downgrade into MEDIUM despite the user-interaction requirement.
• Threat intel is not screaming mass exploitation: no KEV listing and the supplied EPSS is very low, so there is not enough external pressure to push this into CRITICAL.

Why not higher?

This is not unauthenticated drive-by network exploitation against every reachable instance. The chain requires a user click or visit, a live authenticated UI context, and a deployment that actually uses OpenClaw in the first place. Those are compounding prerequisites, and each one meaningfully reduces enterprise-wide exploitability.

Why not lower?

Once the prerequisites are satisfied, the impact is not theoretical or cosmetic. The stolen token grants meaningful operator control, and OpenClaw's own API can be abused to disable guardrails and run commands. Tens of thousands of exposed instances and the ability to compromise even loopback-only setups keep this above MEDIUM.

1. Block unapproved OpenClaw versions — Use EDR, package management, or CI policy to deny execution or rollout of <= 2026.1.28. For a HIGH verdict, deploy this compensating control within 30 days unless patching lands first.
2. Force re-authentication — Invalidate existing gateway/UI tokens where operationally feasible so any previously stolen token dies early. This reduces replay value while you work toward the vendor fix; for HIGH, complete within 30 days.
3. Constrain browser-to-WebSocket egress — Apply proxy, firewall, browser isolation, or outbound filtering controls that make arbitrary browser-initiated WebSocket connections to unknown destinations harder. This directly attacks the token-exfil leg and should be in place within 30 days.
4. Run OpenClaw as a low-privilege account — Drop local privileges, isolate working directories, and remove unnecessary access to cloud creds, SSH material, and admin-only resources. This does not fix the bug, but it cuts blast radius if exploitation occurs; do it within 30 days.
5. Alert on dangerous gateway changes — Monitor for config.patch, approval-policy changes, execution-host changes, and suspicious child-process launches from OpenClaw or browser-adjacent contexts. Instrumentation can be rolled out within 30 days and gives you a fighting chance to catch abuse.

Run this on the target host that has OpenClaw installed, or via your software distribution/remote execution tooling. Invoke it as python3 verify_openclaw_cve_2026_25253.py or python verify_openclaw_cve_2026_25253.py; no admin rights are required unless your environment restricts access to the openclaw binary.

#!/usr/bin/env python3
# verify_openclaw_cve_2026_25253.py
# Checks whether installed OpenClaw version is vulnerable to CVE-2026-25253.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import re
import shutil
import subprocess
import sys

PATCHED_VERSION = (2026, 1, 29)


def parse_version(text):
    # Accept forms like:
    #   2026.1.29
    #   v2026.1.29
    #   openclaw 2026.1.29
    m = re.search(r'v?(\d{4})\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def get_version_output():
    exe = shutil.which('openclaw') or shutil.which('clawdbot') or shutil.which('moltbot')
    if not exe:
        return None, 'binary not found in PATH'

    commands = [
        [exe, '--version'],
        [exe, 'version'],
    ]

    for cmd in commands:
        try:
            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
            out = (proc.stdout or '') + '\n' + (proc.stderr or '')
            if out.strip():
                return out.strip(), None
        except Exception as e:
            last_error = str(e)
    return None, last_error if 'last_error' in locals() else 'unable to execute version command'


def compare_versions(a, b):
    return (a > b) - (a < b)


def main():
    output, err = get_version_output()
    if output is None:
        print(f'UNKNOWN - could not determine version: {err}')
        sys.exit(2)

    version = parse_version(output)
    if version is None:
        print('UNKNOWN - version string not recognized')
        print(output)
        sys.exit(2)

    if compare_versions(version, PATCHED_VERSION) >= 0:
        print(f'PATCHED - detected version {version[0]}.{version[1]}.{version[2]} (fixed in 2026.1.29)')
        sys.exit(0)
    else:
        print(f'VULNERABLE - detected version {version[0]}.{version[1]}.{version[2]} (< 2026.1.29)')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. GitHub Advisory GHSA-g8p2-7wf7-98mq
2. NVD CVE-2026-25253
3. depthfirst research write-up
4. Censys exposure analysis
5. Bitsight exposure analysis
6. CISA Known Exploited Vulnerabilities Catalog