OpenClaw, formerly known as Clawdbot and Moltbot, is an open-source autonomous AI personal assistant that runs locally on user devices and integrates with various messaging platforms. A critical vulnerability identified as CVE-2026-25253 with a CVSS score of 8.8 enables remote code execution through a crafted malicious link. The root cause lies in the Control UI trusting the gatewayUrl parameter from the query string without validation and automatically connecting on page load, sending the stored gateway token in the WebSocket connection payload. The server also fails to validate the WebSocket origin header, allowing cross-site WebSocket hijacking. When a victim clicks a malicious link or visits a crafted webpage, attacker-controlled JavaScript running in the victim's browser steals the authentication token and establishes a WebSocket connection to the local OpenClaw gateway. Using the stolen token, the attacker gains operator-level access to the gateway API, enabling arbitrary configuration changes and disabling security features such as user confirmation prompts and sandboxing. This allows the attacker to escape container restrictions and execute arbitrary commands directly on the host machine, achieving one-click RCE. The vulnerability is exploitable even if the gateway binds only to localhost because the victim's browser initiates the outbound connection, effectively bypassing network restrictions. The flaw was discovered by security researcher Mav Levin and patched in OpenClaw version 2026.1.29 released on January 30, 2026. Despite the patch, the rapid adoption of OpenClaw since its November 2025 release and its use in sensitive environments make this vulnerability highly critical. The architectural design of OpenClaw's safety features, intended to mitigate malicious LLM prompt injections, does not protect against this exploit, increasing the blast radius of the attack.

For European organizations, this vulnerability poses a severe risk of full system compromise on devices running OpenClaw. Since OpenClaw operates locally and integrates with messaging platforms, attackers can leverage this flaw to gain persistent, privileged access to user environments, potentially leading to data theft, espionage, or disruption of critical services. The ability to disable security controls and escape container sandboxes increases the likelihood of lateral movement and deeper network infiltration. Organizations relying on OpenClaw for automation or AI assistance in sensitive sectors such as finance, healthcare, or government could face significant confidentiality, integrity, and availability impacts. The exploit requires only user interaction via a single click, making phishing campaigns highly effective. Additionally, the vulnerability bypasses localhost restrictions, increasing the attack surface even in well-segmented networks. The lack of known active exploits currently provides a window for mitigation, but the rapid spread of OpenClaw adoption in Europe elevates the urgency. Failure to patch could lead to widespread compromise, data breaches, and operational disruptions.

European organizations should immediately upgrade all OpenClaw instances to version 2026.1.29 or later, which addresses this vulnerability. Network administrators should implement strict Content Security Policies (CSP) and browser security settings to limit the execution of untrusted scripts and prevent malicious WebSocket connections. Employ endpoint detection and response (EDR) solutions to monitor for suspicious WebSocket activity and unauthorized configuration changes in OpenClaw. Disable or restrict OpenClaw usage on critical systems until patched. Conduct user awareness training focused on phishing and malicious link risks, emphasizing the danger of clicking unknown URLs. Consider isolating OpenClaw instances within hardened containers or virtual machines with strict network egress controls to limit potential damage. Review and audit OpenClaw configurations to ensure minimal privileges and enable any available security features. Monitor threat intelligence feeds for emerging exploit attempts and indicators of compromise related to this vulnerability. Finally, engage with OpenClaw developers and community to stay informed about further security updates or mitigations.