Researchers Find 17,500+ Internet-Exposed OpenClaw Instances Vulnerable to Credential Theft

Article Details

Defense Focus

Identify and remediate internet-exposed OpenClaw, Clawdbot, and Moltbot instances affected by CVE-2026-25253.

Detection Methods

• Match HTML page titles for the Clawdbot Control, Moltbot Control, and OpenClaw Control variants.
• Fingerprint HTTP responses using normalized, sorted, or unique-header Murmur3 hashes and redacted-header SHA256 hashes.
• Match HTML response-body SHA256 hashes, Murmur3 hashes, or TLSH fuzzy hashes.
• Search HTML for version-specific JavaScript and CSS asset filenames.
• Match JA4X TLS certificate fingerprints and characteristic Content-Length values.
• Use port filters for 18789 and 18791 as an additional condition, not as the sole detection method; the article reports deployments on other ports, including 80, 443, 8080, and 18888.

Data Sources

• HTTP response HTML titles and body content
• HTTP response headers and Content-Length
• TLS certificate properties
• Observed service ports
• Hunt.io internet-scanning results

Rule Types

• HuntSQL queries using SQL LIKE and case-insensitive RLIKE title matching
• Exact hash-set matching for HTTP headers and HTML bodies
• TLSH fuzzy-hash matching for modified HTML bodies
• Substring matching for JavaScript and CSS asset filenames
• JA4X TLS certificate fingerprint matching
• Content-Length value matching combined with port filters

Platforms

• Hunt.io

Defensive Actions

• Restrict inbound access to ports 18789 and 18791 from untrusted networks and avoid exposing these services directly to the public internet.
• Assume API keys and authentication tokens stored in exposed instances may be compromised; rotate them and review API usage logs for unusual activity.
• Place administrative access behind VPN, bastion hosts, zero-trust network access, private network segments, or authenticated reverse proxies.
• Apply security patches from framework maintainers and monitor project repositories and security advisories.