OpenClaw vulnerability allows 1-click RCE via unvalidated gateway URL
OpenClaw, an open-source AI personal assistant, contained a vulnerability allowing attackers to execute code on victim machines through a malicious URL. The flaw involved unvalidated gateway URL parameters that were auto-connected with authentication tokens, enabling full gateway compromise when users visited crafted links.
What happened
OpenClaw's Control UI blindly accepts a gatewayUrl query parameter from the URL and persists it to storage without validation. The application then immediately auto-connects on page load, automatically bundling the stored security-sensitive authToken into the WebSocket connection handshake to the new gateway.
A malicious actor can craft a URL containing an attacker-controlled gatewayUrl and trick a user into visiting it, causing their authentication token to be sent to the attacker's server. The attacker can then connect to the victim's local gateway and gain operator-level access.
Reported impact
With operator-level access to the gateway API, an attacker gains arbitrary config change and code execution capabilities on the gateway host. The vulnerability is exploitable even on instances configured to listen on loopback only, since the victim's browser initiates the outbound connection.
Index analysis
The vulnerability results from a combination of three unsafe operations: the application accepting and persisting an unvalidated gatewayUrl parameter, auto-connecting immediately after settings are applied, and automatically including the authToken in the connection handshake. Each operation is safe in isolation, but together they create a critical security flaw.
Governance controls
The patched version v2026.1.29 requires users to confirm the new gateway URL in the UI before connecting, adding user interaction as a protection against token exfiltration.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.