CVE-2026-25253: OpenClaw Clawdbot authentication token exfiltration via untrusted gatewayUrl

CVE-2026-25253 · Severity: low · CVSS 3.1 · Published 2026-02-02

Clawdbot is a Node.js application that provides a control interface for gateway instances. An attacker can craft a malicious link that tricks an authenticated user into revealing their authentication token, allowing the attacker to gain full operator access to the victim's gateway and execute arbitrary code on it. The attack works even when the gateway is configured to accept connections only from the local machine.

Technologies: clawdbot (npm). Vendors: npm.

Quick answers

Is CVE-2026-25253 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25253 being exploited in the wild.
How severe is CVE-2026-25253?
Low severity, with a CVSS score of 3.1, published 2 February 2026.
Which products and versions are affected?
clawdbot (npm) SEMVER:introduced=0,fixed=2026.1.29.
Is there a fix for CVE-2026-25253?
Yes. clawdbot (npm): upgrade to 2026.1.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25253 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-25253?
Check whether you run clawdbot (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • clawdbot (npm): upgrade to 2026.1.29 or later
    npm install clawdbot@2026.1.29

Technical details

The vulnerability stems from a lack of input validation on the gatewayUrl parameter in the query string combined with auto-connect behavior on page load. The Control UI accepts a gatewayUrl parameter without validation and automatically connects to it, transmitting the stored gateway authentication token in the WebSocket connect payload. An attacker can craft a malicious URL or trick a user into visiting an attacker-controlled website, causing the victim's browser to exfiltrate the token to an attacker-controlled server. Once obtained, the attacker can connect to the victim's gateway API with operator-level privileges, modify configurations (including sandbox and tool policies), and invoke privileged actions leading to remote code execution on the gateway host. This attack bypasses network isolation because the victim's browser initiates the outbound connection. The fix requires users to manually confirm new gateway URLs in the UI before connecting.

Affected products

  • OpenClaw Clawdbot <= 2026.1.28

Identifiers

  • CVE-2026-25253
  • GHSA-g8p2-7wf7-98mq

Timeline

  • 2026-02-02: disclosed: Published on GitHub
  • 2026-02-02: patched: Fixed in version 2026.1.29

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.