OpenClaw Faces Critical Security Vulnerabilities

🔑 Enhanced Key Takeaways

• •Security researchers identified over 17,500 internet-exposed instances of OpenClaw, Clawdbot, and Moltbot vulnerable to CVE-2026-25253, allowing unauthenticated extraction of API tokens for services like Claude, OpenAI, and Google AI via the /api/export-auth endpoint.[1]
• •Attackers distributed 341 malicious skills (12% of ClawHub marketplace) disguised as legitimate tools, deploying keyloggers on Windows and Atomic Stealer on macOS during the January 2026 ClawHavoc campaign.[5]
• •Censys detected 21,639 publicly accessible OpenClaw instances by January 31, 2026, with the US hosting the most and China (30% on Alibaba Cloud) second, many leaking plaintext credentials.[5]

🛠️ Technical Deep Dive

• •CVE-2026-25253 (CVSS 8.8) enables one-click RCE via WebSocket hijacking: malicious JavaScript on a webpage opens a local WebSocket connection, exfiltrates the gateway auth token, and grants full admin control, exploitable even on localhost-bound instances due to lack of origin validation.[1][2][3][4]
• •The /api/export-auth endpoint lacks authentication, exposing stored API keys in plaintext config files; infostealers like RedLine target these paths alongside browser creds.[1][2]
• •Additional flaws include CVE-2026-24763 and CVE-2026-25157 (command injection), no rate limiting on auth attempts, and ClawHub skills passing secrets through LLM context windows.[3][5]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline