8.8

CVE-2026-25253

Medienbericht
Exploit
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
OpenClaw ≫ OpenClaw SwPlatformnode.js Version < 2026.1.29
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.02% 0.94
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cve@mitre.org 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-669 Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
02.02.2026 08:52
https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys
Third Party Advisory
Exploit
https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq
Vendor Advisory
https://openclaw.ai/blog
Product
https://ethiack.com/news/blog/one-click-rce-moltbot
Third Party Advisory
Exploit
https://x.com/0xacb/status/2016913750557651228
Exploit