OpenClaw ships a fix for CVE-2026-25253
AIMade by AIWritten by AI (Claude) from the source below. Check anything important against the source.How it's made
Shipped a fix for CVE-2026-25253 — the Control UI accepted unauthenticated WebSocket connections and trusted gatewayUrl without validation, enabling token theft followed by one-click RCE (CVSS 8.8)
Why it matters
The first major incident to shatter the assumption that local agents are safe. Origin validation has since become a baseline requirement
Source — Primary sources first; secondary reports are labelled “Press”
Pressthehackernews.comhttps://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.htmlAdded in Week 35, 2026 · See that week
On the map — ㉒ Agent Security line
- Previous stopCisco finds 26% of 31,000 agent skills have at least one vulnerability
- This recordOpenClaw CVE
- Next stopDefenseClaw