Latest OpenClaw vulnerability: CVE-2026-25253 #
depthfirst has reported a vulnerability in the OpenClaw personal assistant tool. This flaw allows a remote, unauthenticated attacker one-click remote code execution via authentication token exfiltration exposed through a WebSocket. Successful exploitation could allow complete system compromise.
This vulnerability has been assigned CVE-2026-25253 and is rated high has a CVSS score of 8.8.
The following versions are affected
- OpenClaw versions up to but not including 2026.1.29
What is OpenClaw? #
OpenClaw is an open-source, autonomous AI personal assistant that runs locally on user devices. It is designed to manage digital tasks by interacting with apps and websites on the user's behalf.
What is the impact? #
Successful exploitation of this vulnerability would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
The OpenClaw project has released version 2026.1.29 of OpenClaw. Users are urged to update as quickly as possible.
How to find potentially vulnerable systems with runZero #
From the Software inventory, use the following query to locate potentially vulnerable assets:
vendor:=OpenClaw product:=OpenClaw
