CVE-2026-25253
Published: 01 February 2026
Summary
CVE-2026-25253 is a high-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-25253 by requiring timely remediation through patching to version 2026.1.29 or later, preventing automatic WebSocket connections to malicious endpoints.
Requires validation of untrusted query string inputs like gatewayUrl to block connections to attacker-controlled WebSocket endpoints without user prompting.
Enforces flow control policies to prevent the transmission of tokens over unauthorized WebSocket connections initiated from malicious query parameters.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly enables one-click client exploitation via malicious link (T1204.001) that triggers automatic WebSocket connection to attacker endpoint, resulting in RCE (T1203) and theft/transmission of application access token (T1528).
NVD Description
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
Deeper analysisAI
CVE-2026-25253 is a vulnerability in OpenClaw (also known as clawdbot or Moltbot) versions prior to 2026.1.29. The issue stems from the software obtaining a gatewayUrl value from a query string and automatically establishing a WebSocket connection without user prompting, which results in sending a token value over that connection. This flaw is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-669.
Attackers can exploit this vulnerability remotely without privileges by tricking a user into interacting with a malicious link containing a controlled gatewayUrl in the query string. Upon user interaction, such as clicking the link, the software connects to the attacker's WebSocket endpoint and transmits the token, enabling high-impact confidentiality, integrity, and availability consequences.
Mitigation guidance from advisories, including the GitHub Security Advisory GHSA-g8p2-7wf7-98mq, recommends updating to OpenClaw version 2026.1.29 or later. Further details on patches and exploitation techniques are provided in references such as depthfirst.com, ethiack.com, openclaw.ai/blog, and an X post by @0xacb.
References highlight real-world exploitation demonstrations, including one-click remote code execution to steal Moltbot data and keys, as detailed in the linked blog posts.
Details
- CWE(s)