CVE-2026-25253

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 24.43%
EPSS Percentile: 97.83%
CISA KEV: Not listed

Description

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 02-Feb-2026 06:15
Last Modified: 17-Jun-2026 17:24
EPSS Date: 2026-10-10
CWE: CWE-669

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

openclaw / openclaw
Version / affected range: * · before (exclusive) 2026.1.29
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

References

Last enrichment sync: 11-Oct-2026 10:24
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE-2026-25253: a gatewayUrl vulnerability in OpenClaw Kaspersky Reports Rising Vulnerability Disclosures and Early Exploit Releases in Q2 2026
In reaction to the recent CVE-2026-25253, our research team set out to understand how this vulnerability appears in real-world deployments and what could be identified at internet scale using Hunt.io. Researchers Find 17,500+ Internet-Exposed OpenClaw Instances Vulnerable to Credential Theft

CVE (26)

People (2)

Vendors (3)

Products (20)

Tools (4)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.