PT-2026-5584 · Openclaw · Openclaw
0Xacb
+2
·
Published
2026-01-31
·
Updated
2026-05-15
·
CVE-2026-25253
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.1.29
Description
An authentication bypass issue exists in the WebSocket gateway of OpenClaw. The software fails to validate the user-supplied
gatewayUrl parameter before initializing WebSocket connections. This allows unauthenticated remote attackers to exfiltrate bearer tokens and perform server-side request forgery (SSRF), which is a technique where an attacker forces a server to make requests to internal or external resources.Exploitation can lead to the disclosure of authentication tokens, theft of cloud metadata and IAM credentials, and full compromise of connected automation workflows. In some configurations, this can allow attackers to execute arbitrary code on the host machine, potentially granting access to the file system and shell. Active exploitation has been observed in the wild.
Recommendations
Upgrade to OpenClaw version 2026.1.29 or later.
Restrict external access to OpenClaw dashboard endpoints.
Deploy WAF rules to block malicious
gatewayUrl values.
Enforce strict egress filtering.
Rotate all exposed credentials.Exploit
Fix
RCE
LPE
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw