Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 2 February 2026.

Which products and versions are affected?

clawdbot (npm) SEMVER:introduced=0,fixed=2026.1.29.

Is there a fix for This vulnerability?

Yes. clawdbot (npm): upgrade to 2026.1.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run clawdbot (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

OpenClaw clawdbot token exfiltration via unvalidated gatewayUrl

Severity: low · CVSS 3.1 · Published 2026-02-02

OpenClaw's Control UI (a gateway management interface) automatically connects to a WebSocket server address taken from a URL parameter without validating it, and sends authentication tokens to that connection. An attacker can craft a malicious link that tricks a user into connecting to an attacker-controlled server, stealing their gateway token. With the token, the attacker gains full operator-level access to the victim's gateway and can execute arbitrary commands on the underlying host.

Technologies: clawdbot (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 2 February 2026.
Which products and versions are affected?: clawdbot (npm) SEMVER:introduced=0,fixed=2026.1.29.
Is there a fix for This vulnerability?: Yes. clawdbot (npm): upgrade to 2026.1.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run clawdbot (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

clawdbot (npm): upgrade to 2026.1.29 or later
```
npm install clawdbot@2026.1.29
```

Technical details

The vulnerability is a missing input validation flaw (CWE-669) in the Control UI's gatewayUrl parameter handling. The UI automatically initiates a WebSocket connection to the URL specified in the query string without any validation or user confirmation, and sends the stored gateway authentication token in the WebSocket handshake payload. An attacker can craft a link to a malicious gatewayUrl and send it to a user; when the victim clicks the link or visits a malicious site that redirects to it, the browser opens the Control UI and immediately connects to the attacker's server, exfiltrating the token. The attacker can then use this token to connect to the victim's gateway API as an authenticated operator and execute privileged actions, including arbitrary code execution on the gateway host. This attack succeeds even if the gateway only listens on loopback (127.0.0.1) because the victim's browser initiates the outbound connection on behalf of the attacker. The vulnerability was patched in version 2026.1.29 by requiring users to confirm the gateway URL in the UI before connecting.

Affected products

OpenClaw clawdbot <=2026.1.28

Timeline

2026-01-31: disclosed: Advisory GHSA-g8p2-7wf7-98mq published
2026-01-31: patched: Fixed in version 2026.1.29
2026-02-02: other: GHSA-r2c6-8jc8-g32w marked as duplicate and withdrawn

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.