Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-25 · source-backed
CVE-2026-25253 (CVSS 8.8) enables millisecond-speed one-click RCE against OpenClaw. The attack exploits missing WebSocket origin header validation: visiting a malicious page triggers cross-site WebSocket hijacking → exfiltrates gateway token → disables sandboxing → escapes Docker → full RCE on host. Endor Labs separately disclosed 6 additional vulnerabilities (SSRF, path traversal, auth bypass). 1,862 publicly exposed instances detected. Patched in v2026.1.29 with Trust-on-First-Use and origin validation. Users must rotate gateway tokens and API keys immediately. (The Hacker News, Endor Labs)
Each link below shares sources, entities, or timing with this story.
OpenClaw released ClawHub / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (OpenClaw released ClawHub); both cover OpenClaw, SSRF, The Hacker News; reported by the same outlet (thehackernews.com).
Microsoft released OpenClaw / Shared entities / Same source domain / What happened next
Linked by a graph relationship (Microsoft released OpenClaw); both cover CVSS, RCE, The Hacker News; reported by the same outlet (thehackernews.com).
Microsoft released OpenClaw / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Microsoft released OpenClaw); both cover CVSS, RCE; overlapping topics (auth, chain).
OpenClaw uses Claude Code / Shared entities / Shared topic / What happened next
Linked by a graph relationship (OpenClaw uses Claude Code); both cover CVSS, RCE; overlapping topics (against, attack, token).
Oasis Security criticizes OpenClaw / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Oasis Security criticizes OpenClaw); both cover OpenClaw, Patched, WebSocket; overlapping topics (attack, gateway, openclaw, websocket).
OpenClaw uses Claude Code / Shared entity: OpenClaw / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (OpenClaw uses Claude Code); both cover OpenClaw; reported by the same outlet (thehackernews.com).
Anthropic deprecates OpenClaw / Shared entities / Same source
Linked by a graph relationship (Anthropic deprecates OpenClaw); both cover OpenClaw CVE, The Hacker News; cite the same source (The Hacker News).
Microsoft released OpenClaw / Shared entity: CVSS / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Microsoft released OpenClaw); both cover CVSS; reported by the same outlet (thehackernews.com).