Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

OpenClaw Control UI crafted-link RCE (CVE-2026-25253)

Vulnerability
First reported
Last updated
Happening score
H score 32
1 unique sources, 1 articles

Summary

Hide ▲

OpenClaw CVE-2026-25253 is a high-severity 1-click RCE flaw that can expose gateway tokens and enable full gateway compromise on impacted instances. The weakness sits in the Control UI, which trusts `gatewayUrl` from the query string without validation and fails to check the WebSocket origin. A crafted malicious link or malicious page can trigger token theft and privileged gateway access. The issue was fixed in version 2026.1.29.

Related Happenings

OpenClaw command-injection, path-traversal, and link-following flaws (multiple vulnerabilities)

Vulnerability
H score33 First: 10.07.2026 17:19 Last: 10.07.2026 17:19 Sources 1

About this happening: OpenClaw now has three patched high-severity vulnerabilities that can lead to credential theft, privilege escalation, and arbitrary code execution on the host....

Open Happening

OpenClaw ClawJacked localhost WebSocket brute-force security flaw

Vulnerability
H score37 First: 01.03.2026 23:44 Last: 01.03.2026 23:44 Sources 1

About this happening: OpenClaw’s ClawJacked vulnerability allowed a malicious website to brute-force a localhost WebSocket connection and take control of a local instance, putting ses...

Open Happening

BeaverTail and InvisibleFerret backdoor delivery via malicious VS Code task abuse

Malware Activity
H score39 First: 20.01.2026 20:41 Last: 20.01.2026 20:41 Sources 1

About this happening: North Korean threat actors tied to Contagious Interview are running the PolinRider malware activity across 108 unique packages and browser extensions on npm, Pac...

Latest development: 22.04.2026 17:48

North Korean actor Void Dokkaebi, aka Famous Chollima, is turning the Contagious Interview fake-job lure into a self-propagating software supply-chain infection that abuses compromised developer repositories, malicious VS Code tasks, and injected code to spread malware and steal credentials. The campaign targets developers seeking work, can hide a poisoned .vscode folder in committed code, and Trend Micro said it found more than 750 infected code repositories, more than 500 malicious VS Code task configurations, and 101 commit-tampering instances in March.

Open Happening

Timeline

  1. 02.02.2026 18:28 1 articles · 5mo ago

    OpenClaw releases fix for CVE-2026-25253

    Mitigation Patch Update

    OpenClaw released version 2026.1.29 on January 30, 2026 to address CVE-2026-25253, a high-severity flaw tied to crafted malicious links, token exfiltration, full gateway compromise, and 1-click RCE against the Control UI and gateway API.

    Show sources
    Open in new tab
  2. 02.02.2026 18:28 2 articles · 5mo ago

    OpenClaw discloses Control UI one-click RCE

    Initial Disclosure

    OpenClaw publicly disclosed CVE-2026-25253 on February 2, 2026, describing a Control UI flaw where `gatewayUrl` from the query string is trusted without validation and the WebSocket origin is not checked, allowing a crafted malicious link or malicious web page to steal the stored gateway token, bypass authentication, and reach operator-level access and code execution on the gateway host.

    Show sources
    Open in new tab