OpenClaw Bypasses EDR, DLP, IAM Silently

🔑 Enhanced Key Takeaways

• •OpenClaw has experienced a cascade of at least 10+ CVEs since January 2026, with CVE-2026-25253 (CVSS 8.8) enabling one-click RCE through WebSocket token exfiltration, patched in version 2026.1.29 released January 30, 2026[1][5]
• •Six additional vulnerabilities were disclosed by Endor Labs in February 2026, including SSRF bugs (CVE-2026-26322, CVSS 7.6), missing webhook authentication (CVE-2026-26319, CVSS 7.5), and path traversal flaws, with some having public exploit code available[3]
• •SecurityScorecard reported tens of thousands of misconfigured OpenClaw instances exposed to the public internet, enabling threat actors to gain full access to corporate systems the instances can interact with[3]
• •Multiple authentication and access control failures persist: missing WebSocket origin validation, localhost trust bypass behind reverse proxies, guest mode privilege escalation, and exposed mDNS broadcasts revealing filesystem paths and SSH availability[4]
• •Indirect prompt injection via web browsing (CVE-2026-22708) allows attackers to embed hidden CSS-invisible instructions in webpages that the agent's scraper reads, turning the web into a command-and-control channel[4]

🛠️ Technical Deep Dive

• •CVE-2026-25253 exploitation chain: Attacker crafts malicious link with gatewayUrl parameter → victim clicks while authenticated → applySettingsFromUrl() stores attacker-controlled endpoint → WebSocket connection sends authentication token, device ID, and public key → attacker captures token and reconnects to legitimate gateway with stolen credentials[1]
• •Privilege escalation mechanism: Attacker disables sandbox by setting 'exec.approvals.set' to 'off' and escapes Docker container by setting 'tools.exec.host' to 'gateway', achieving full RCE on host system[1][5]
• •WebSocket vulnerability root cause: Control UI trusts gatewayUrl from query string without validation, auto-connects on load, and sends stored gateway token in WebSocket connect payload; server accepts connections from any origin due to missing origin validation[5]
• •CVE-2026-24763 command injection: Unsafe handling of PATH environment variable in Docker sandbox execution mechanism allows authenticated users controlling environment variables to influence command execution within container context[6]
• •Indirect prompt injection mechanism: OpenClaw does not sanitize web content before feeding into LLM context window; attackers create webpages with hidden CSS-invisible instructions that agent's scraper reads and interprets as system commands[4]
• •Authentication bypass vectors: Missing gateway authentication by default in many deployments, localhost connections auto-approved, guest mode logic error retains tool trigger permissions despite downgraded session, and mDNS broadcasts expose infrastructure details[4]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline