{"schema_version":"0.10.0","id":"LR-2026-0421","record_version":1,"title":"OpenClaw one-click remote code execution via crafted malicious link (CVE-2026-25253)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"2005dfaa3902b89ea588a203bd2e19e3d34dcf23ee3b8753c6272198c8100ec0"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":"operator.admin and operator.approvals scopes","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-02","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"OpenClaw, an open-source autonomous AI personal assistant that runs locally on user devices, was found to have a high-severity flaw, tracked as CVE-2026-25253, that could allow remote code execution through a crafted malicious link. The Control UI trusted a gatewayUrl from the query string and sent the stored gateway token to an attacker-controlled server. Using the stolen token, an attacker could connect to a victim's local gateway, change sandbox and tool policies, and invoke privileged actions. Security researcher Mav Levin, credited with discovering the flaw, described a one-click exploit chain that takes milliseconds after a victim visits a single malicious web page. The issue was addressed in version 2026.1.29, released on January 30, 2026.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03","secondary_risks":["RK05","RK08"],"control_chain":[{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"E1","outcome":"got_around","reason":null,"quote":"To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting \"exec.approvals.set\" to \"off\" and escape the container used to run shell tools by setting \"tools.exec.host\" to \"gateway.\"","source_index":0,"reviewed":false},{"layer":"L3","party":"deployer","party_name":null,"control_id":"B1","outcome":"got_around","reason":null,"quote":"To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting \"exec.approvals.set\" to \"off\" and escape the container used to run shell tools by setting \"tools.exec.host\" to \"gateway.\"","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"E1","outcome":"failed","reason":null,"quote":"And users might think these defenses would protect from this vulnerability (or limit the blast radius), but they don't.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Unbounded scope stated: the flaw impacts any Moltbot deployment where a user has authenticated to the Control UI. No count of affected parties is stated.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html","publisher":"The Hacker News","date":"2026-02-02","type":"press","title":"OpenClaw Bug Enables One-Click Remote Code Execution via Malicious Link - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.permissions_scope":"C","event.incident_class":"C","event.agent_involved":"C","event.adversarial_actor":"C","event.detection_method":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.permissions_scope":[{"source_index":0,"quote":"To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting \"exec.approvals.set\" to \"off\" and escape the container used to run shell tools by setting \"tools.exec.host\" to \"gateway.\""}],"event.incident_class":[{"source_index":0,"quote":"A high-severity security flaw has been disclosed in OpenClaw (formerly referred to as Clawdbot and Moltbot) that could allow remote code execution (RCE) through a crafted malicious link."}],"event.agent_involved":[{"source_index":0,"quote":"OpenClaw is an open-source autonomous artificial intelligence (AI) personal assistant that runs locally on user devices and integrates with a wide range of messaging platforms."}],"event.adversarial_actor":[{"source_index":0,"quote":"The attacker can then connect to the victim's local gateway, modify config (sandbox, tool policies), and invoke privileged actions, achieving 1-click RCE."}],"event.detection_method":[{"source_index":0,"quote":"Mav Levin, founding security researcher at depthfirst who is credited with discovering the shortcoming, said it can be exploited to create a one-click RCE exploit chain that takes only milliseconds after a victim visits a single malicious web page."}],"impact.severity":[{"source_index":0,"quote":"It impacts any Moltbot deployment where a user has authenticated to the Control UI."}],"impact.severity_because":[{"source_index":0,"quote":"It impacts any Moltbot deployment where a user has authenticated to the Control UI."}],"event.control_chain":[{"source_index":0,"quote":"To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting \"exec.approvals.set\" to \"off\" and escape the container used to run shell tools by setting \"tools.exec.host\" to \"gateway.\""},{"source_index":0,"quote":"To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting \"exec.approvals.set\" to \"off\" and escape the container used to run shell tools by setting \"tools.exec.host\" to \"gateway.\""},{"source_index":0,"quote":"And users might think these defenses would protect from this vulnerability (or limit the blast radius), but they don't."}],"event.summary":[{"source_index":0,"quote":"A high-severity security flaw has been disclosed in OpenClaw (formerly referred to as Clawdbot and Moltbot) that could allow remote code execution (RCE) through a crafted malicious link."},{"source_index":0,"quote":"The Control UI trusts gatewayUrl from the query string without validation and auto-connects on load, sending the stored gateway token in the WebSocket connect payload,"},{"source_index":0,"quote":"The attacker can then connect to the victim's local gateway, modify config (sandbox, tool policies), and invoke privileged actions, achieving 1-click RCE."},{"source_index":0,"quote":"Mav Levin, founding security researcher at depthfirst who is credited with discovering the shortcoming, said it can be exploited to create a one-click RCE exploit chain that takes only milliseconds after a victim visits a single malicious web page."},{"source_index":0,"quote":"The issue, which is tracked as CVE-2026-25253 (CVSS score: 8.8), has been addressed in version 2026.1.29 released on January 30, 2026."}]},"notes_on_gaps":"Only one press source was provided, so no independent or government confirmation exists. The article date 2026-02-02 is used as the disclosure date because the source states the flaw 'has been disclosed' without giving a separate disclosure date. The date the vulnerability occurred, the number of affected deployments or victims, and any confirmed exploitation in the wild are not stated. No direct loss, records, or remediation hours are stated. The root cause category, responsible party, and trigger were not set because the sources do not map them to the closed lists; root_cause_detail paraphrases the stated flaw. The E1 and B1 outcomes and the 'missing' outcome for J1 are judgements drawn from the stated sandbox escape, disabled confirmation, and patch. The developer value is taken from the advisory attribution. The 'failed' outcome for E1 relies on the source's statement that the defenses do not protect against this vulnerability. Severity 'major' rests on the stated unbounded scope; no regulator or count is given. Context industry and country are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"OpenClaw, an open-source autonomous AI personal assistant, runs locally on user devices and connects to messaging platforms.","quote":"OpenClaw is an open-source autonomous artificial intelligence (AI) personal assistant that runs locally on user devices and integrates with a wide range of messaging platforms.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The server did not validate the WebSocket origin header, so clicking a link was enough to trigger a cross-site WebSocket hijacking attack.","quote":"The problem is that clicking on the link to that web page is enough to trigger a cross-site WebSocket hijacking attack because OpenClaw's server doesn't validate the WebSocket origin header.","source_index":0,"grade":"C"},{"step":"reached","text":"The attacker could connect to the victim's local gateway, change sandbox and tool policies, and invoke privileged actions.","quote":"The attacker can then connect to the victim's local gateway, modify config (sandbox, tool policies), and invoke privileged actions, achieving 1-click RCE.","source_index":0,"grade":"C"},{"step":"caught","text":"Security researcher Mav Levin, credited with discovering the shortcoming, reported it.","quote":"Mav Levin, founding security researcher at depthfirst who is credited with discovering the shortcoming, said it can be exploited to create a one-click RCE exploit chain that takes only milliseconds after a victim visits a single malicious web page.","source_index":0,"grade":"C"},{"step":"done","text":"The issue was addressed in version 2026.1.29, released January 30, 2026.","quote":"The issue, which is tracked as CVE-2026-25253 (CVSS score: 8.8), has been addressed in version 2026.1.29 released on January 30, 2026.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html"]},"analysis":{"sections":{"timeline":[{"text":"OpenClaw was initially released.","quote":"Although initially released in November 2025, the project has gained rapid popularity in recent weeks, with its GitHub repository crossing 149,000 stars as of writing.","source_index":0,"when":"2025-11"},{"text":"Version 2026.1.29 released, addressing the issue.","quote":"The issue, which is tracked as CVE-2026-25253 (CVSS score: 8.8), has been addressed in version 2026.1.29 released on January 30, 2026.","source_index":0,"when":"2026-01-30"},{"text":"The flaw was disclosed in the source article.","quote":"A high-severity security flaw has been disclosed in OpenClaw (formerly referred to as Clawdbot and Moltbot) that could allow remote code execution (RCE) through a crafted malicious link.","source_index":0,"when":"2026-02-02"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html"]}}