OpenClaw Remote Code Execution Vulnerability Demonstrated

# OpenClaw Remote Code Execution Vulnerability Demonstrated

https://gcdradar.vercel.app/incidents/openclaw-remote-code-execution-vulnerability-demonstrated · AIR-2026-0344 · closed 2026-02-20

- Lane: Research
- Severity: 1 (Research / proof of concept)
- Fix status: Fix status unknown
- First reported: 2026-02-06 (happened 2026-02-01)
- AI role: Attack on AI
- Products: OpenClaw
- CVE ids: CVE-2026-25253
- CVSS: 8.8

## Summary

A security researcher demonstrated a remote code execution vulnerability in the OpenClaw AI assistant via a malicious link. The vulnerability is tracked as CVE-2026-25253.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-02-06: openclaw (https://openclaw.ai/blog/introducing-openclaw)
- 2026-02-06: CVE-2026-25253 (https://nvd.nist.gov/vuln/detail/CVE-2026-25253)
- 2026-02-06: 1-Click RCE To Steal Your Moltbot Data and Keys (CVE-2026-25253) (https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys)
- 2026-02-06: OpenClaw 1-Click Remote Code Execution (https://atlas.mitre.org/studies/AML.CS0050)

## Sources

- 2026-02-06 MITRE ATLAS: OpenClaw 1-Click Remote Code Execution https://atlas.mitre.org/studies/AML.CS0050
- 2026-02-06 depthfirst.com: 1-Click RCE To Steal Your Moltbot Data and Keys (CVE-2026-25253) https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys
- 2026-02-06 NVD: CVE-2026-25253 https://nvd.nist.gov/vuln/detail/CVE-2026-25253
- 2026-02-06 openclaw.ai: openclaw https://openclaw.ai/blog/introducing-openclaw

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.