Skip to content
skopnix

Vulnerability · NVD published 2026-02-01

CVE-2026-25253

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

Signals

Exploited in the wild
Not on KEVNot in CISA's catalogue as of the last daily pull. Absence is not proof of safety.
EPSS · 30-day forecast
24%Chance of exploitation in the next 30 days, 98th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

10 known · links only

GitHub PoCs · by trust, then stars10

  1. ethiack/moltbot-1click-rce ↗Trust ok 100

    Clawdbot/Moltbot/OpenClaw One-click RCE PoC 🦞 (CVE-2026-25253)

    ★ 93 · created 2026-01-27

  2. adibirzu/openclaw-security-monitor ↗Trust ok 100

    Proactive security monitoring for OpenClaw deployments. Detects ClawHavoc, AMOS stealer, CVE-2026-25253, memory poisoning, and supply chain attacks.

    ★ 49 · created 2026-02-05

  3. al4n4n/CVE-2026-25253-research ↗Trust ok 100

    ★ 7 · created 2026-02-08

  4. EQSTLab/CVE-2026-25253 ↗Trust ok 100

    OpenClaw Authentication Token Exfiltration

    ★ 2 · created 2026-03-09

  5. FrigateCaptain/openclaw_vulnerabilities_and_solutions ↗Trust ok 100

    > OpenClaw security audit and hardened deployment guide — known vulnerabilities (CVE-2026-25253, malicious skills, credential leakage), architectural mitigations, and a step-by-step VPS deployment plan

    ★ 2 · created 2026-02-22

  6. KajzingerAkos/CVE-2026-25253 ↗Trust ok 100

    CVE-2026-25253: One-Click RCE in OpenClaw via Auth Token Theft

    ★ 1 · created 2026-04-18

  7. siyad01/agentbox ↗Trust ok 100

    Open-source sandboxed runtime for AI agents — gVisor/Docker isolation, credential vault, immutable audit log. Built after CVE-2026-25253.

    ★ 1 · created 2026-05-10

  8. yym8538/CVE-2026-25253 ↗Trust ok 100

    ★ 1 · created 2026-08-21

  9. cain66666/openclaw-hardening-check ↗Trust ok 100

    Offline, read-only hardening check for a self-hosted OpenClaw install — gateway exposure, auth, CVE-2026-25253. Never prints secrets, makes no network calls.

    ★ 0 · created 2026-07-10

  10. Joseph19820124/openclaw-vuln-report ↗Trust ok 100

    OpenClaw CVE-2026-25253 漏洞分析中文版

    ★ 0 · created 2026-02-06

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

On the wire

1 dispatch
  1. RT by @cyb3rops: Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026). Threat actor also hit http://derouter.ai, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched). New infra IOCs: 203.88.119[.]53 — new primary host post-migration 137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets) 143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic 207.180.56[.]150 — Operator's IP address Domains: 1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating) aitoday[.]me — second service Attribution: SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese. Shodan username via api key: crc2 @malwrhunterteam @500mk500 @MichalKoczwaraKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.