OpenClaw (Clawdbot, Moltbot) CVE-2026-25253 one-click RCE, follow-on CVEs and the ClawHavoc malicious skills on ClawHub

What happened

OpenClaw is a self-hosted personal AI agent. It shipped as Clawdbot in November 2025, was renamed Moltbot on 27 January 2026 after a trademark request from Anthropic, and became OpenClaw on 29 January (Adversa). It runs a local gateway with a web Control UI, and it can run shell commands, drive a browser and install community “skills” from ClawHub.

CVE-2026-25253, one-click RCE (CVSS 8.8). The Control UI took a gatewayUrl value from the page’s query string, connected to it on page load without asking, and sent the stored gateway token in the WebSocket connect message. A crafted link or a malicious site could send that token to the attacker. With it, the attacker could connect to the victim’s gateway, change sandbox and tool policies, and run commands. The advisory notes this worked even on gateways bound to loopback, because the victim’s own browser makes the outbound connection. Version 2026.1.29 fixed it by making the user confirm a new gateway URL (GitHub advisory). The advisory was published on 31 January and the CVE on 1 February. CISA’s SSVC entry records a public proof of concept (CVE record). The advisory credits DepthFirst, 0xacb and mavlevin (GitHub advisory).

The fix version is consistent across the vendor advisory and the CVE record: 2026.1.28 and earlier are affected, 2026.1.29 is fixed.

More OpenClaw CVEs followed:

Sources: CVE-2026-24763, CVE-2026-26322, CVE-2026-26329, CVE-2026-30741. The CVE-2026-30741 record lists vendor, product and version as “n/a” and cites a third-party proof-of-concept repository, not a vendor advisory. Treat its scope as unconfirmed.

ClawHavoc, malicious skills. Koi Security audited 2,857 skills on ClawHub and found 341 malicious ones, about 12%. Between 27 and 29 January, 335 of them delivered Atomic Stealer (AMOS) to macOS users through a fake “Prerequisites” step, and 6 contained reverse shells. All used one command-and-control address, 91.92.242[.]30 (Adversa). Later reports gave higher counts; we have not verified them.

Exposure. Censys counted 21,639 publicly reachable instances on 31 January 2026, up from about 1,000 a week earlier (Adversa).

Am I affected?

# Installed version, under any of the three names
openclaw --version
npm ls -g openclaw clawdbot moltbot

# Is the gateway listening beyond loopback? (Adversa names ports 18789 and 3000)
lsof -nP -iTCP -sTCP:LISTEN | grep -E ':(18789|3000) '

# Installed skills and config
ls ~/.openclaw/

You are affected by CVE-2026-25253 if you ran any version before 2026.1.29 and opened a link in a browser that could reach the Control UI. You are affected by the 2026.2.14 bugs if your gateway accepts connections from people or tools you do not fully trust.

Check your config for the values Adversa lists as signs of the exploit chain: exec.approvals.set turned off and tools.exec.host set to gateway (Adversa).

For ClawHavoc, read every installed skill. A skill that asks you to run a downloaded binary or a curl ... | sh “prerequisite” is the pattern Koi found. Any contact with 91.92.242.30 in DNS, proxy or firewall logs means a stealer likely ran.

What to do now

1. Update to OpenClaw 2026.2.14 or later. That covers the four CVEs with vendor fixes. If you still run the clawdbot or moltbot package, move to the openclaw package (CVE-2026-26322).
2. Rotate secrets on any install that ran before 2026.1.29. Adversa’s guidance is to assume compromise: replace the gateway token and every model API key, OAuth token and credential the agent could read (Adversa).
3. Never expose the gateway. Bind the Control UI to 127.0.0.1, not 0.0.0.0, and reach it remotely only over a VPN such as Tailscale. Set gateway.auth.password (Adversa).
4. Run the built-in audit: openclaw security audit --deep --fix (Adversa).
5. Remove unreviewed skills, and read the source before installing new ones. In a company, block ClawHub or allow only a curated skill list. On Macs where a ClawHub skill ran a “prerequisite” installer, treat the machine as infected with an infostealer: reimage it and rotate browser-saved passwords, session cookies and wallet keys.
6. Contain the agent if it runs in Docker: use --read-only and --cap-drop=ALL, and set a hard spending limit on each model API key (Adversa).

Why this matters

Binding to localhost did not protect against CVE-2026-25253. The victim’s browser made the connection out to the attacker, carrying the token with it (GitHub advisory). Any local agent with a web UI and a stored token needs the same check: does it ever connect somewhere because a URL told it to?

Sources

• GitHub advisory GHSA-g8p2-7wf7-98mq: OpenClaw, CVE-2026-25253
• CVE record: CVE-2026-25253
• CVE record: CVE-2026-24763
• CVE record: CVE-2026-26322
• CVE record: CVE-2026-26329
• CVE record: CVE-2026-30741
• Adversa: OpenClaw security 101, vulnerabilities and hardening