One-click RCE on Clawd/Moltbot in under 2 hours with Hackian

Clawdbot — The former name of an open-source AI assistant project capable of running locally on users' devices (e.g., scheduling appointments, sending messages, automating various tasks, etc.), which gained significant popularity in late 2025 to early 2026.

Vulnerability Found (CVE-2026-25253)

This vulnerability lies in a feature where the app accepts the “gatewayUrl” connection setting from a URL parameter and automatically connects to a WebSocket without verifying the origin or performing proper authentication.

This behavior is the primary cause of authentication token leakage from the user's Local Storage to an attacker’s server, serving as the starting point for a full-scale attack.

Attack Steps (Exploit Chain)

Based on analysis from articles and technical reports: Recon & Web Application Analysis Attackers or scripts (e.g., AI pentester like Hackian mentioned in the article) explore the app and discover WebSocket handling and session token management via client-side JavaScript. Create a Malicious Webpage or URL The webpage embeds JavaScript code to redirect the gatewayUrl parameter to a WebSocket server controlled by the attacker. Victim Clicks the Link When the victim opens the link/webpage in a browser running OpenClaw in the background, the webpage instructs the app to reconnect the WebSocket and send the token. Steal Authentication Token The token stored in Local Storage is sent to the attacker's server via the WebSocket channel without verifying the origin hierarchy. Hijack Session and Reconnect The attacker uses the token to connect to the victim’s Local OpenClaw Gateway, gaining the same privileges as the legitimate user. Execute Malicious Commands (RCE) Once access is obtained, the attacker can execute commands on the victim’s machine, such as disabling the sandbox, modifying configurations, or directly executing unsafe shell commands (RCE).

Why It’s Highly Dangerous No authentication is required before the attack — the victim merely needs to visit the prepared webpage. Attackers can gain high-level control of the system and execute full-scale commands on the victim’s machine.

Prevention and Current Status This vulnerability has been patched in OpenClaw version 2026.1.29 (or later) — users should update immediately. If a link was clicked while running an older version, users should reset tokens and rotate passwords/API keys as the tokens may have already been compromised.

Reference https://ethiack.com/news/blog/one-click-rce-moltbot

Poc Repository