Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

OpenClaw 1-click remote code execution via cross-site WebSocket hijacking of the gateway token

AIR-2026-0027 AIR record · 2026-01-openclaw-gatewayurl-one-click-rce
Open in dashboard About
From the supporting source
With this exploit, a single visit to a malicious webpage was enough to hack your computer and AI assistant.depthfirst.com
The record
Disclosed
2026-02-01
Vendor
OpenClaw project
Product
OpenClaw
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target (contested) — cross-site WebSocket hijack of the gateway token
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Malicious link csrf websocket
Impact type
Code execution, Credential theft, Full host compromise, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0012 – Valid Accounts
NIST AI RMF
MEASURE 2.7
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Use secure credential storage; Implement short-lived tokens.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
OpenClaw installs (project claims 100k+ users) on affected versions
Capability abused
gateway_apiconfig_writeconfirmation_disablecontainer_escapegateway_authenticationtool_execution
Defense & remediation
Recorded defense
localhost binding + user confirmation for tool use
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
patched in OpenClaw (CVE-2026-25253)
Taxonomy & references
OWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI03 Identity and Privilege AbuseATLAS AML.CS0050CVE-2026-25253cswshtoken_theftapproval_bypasscontainer_escapetoken_leakageopen_redirect_style_trustone_clickagent_control_plane
Curator notes
depthfirst. Chain: gatewayUrl query param -> forced WebSocket handshake leaking authToken -> config modification disabling user confirmation -> container escape. | Merged from duplicate id `2026-02-openclaw-1click-rce`. Also reported as: 'CVE-2026-25253: OpenClaw Control UI trusted an attacker-supplied gatewayUrl, leaking the auth token and yielding one-click RCE'.
Supporting sources
Cite as
Enkrypt AI. "OpenClaw 1-click remote code execution via cross-site WebSocket hijacking of the gateway token". AIR, AIR-2026-0027. https://agentincident.vercel.app/i/AIR-2026-0027/ (accessed 2026-10-19).