---
id: 5439
title: "1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253)"
cve: CVE-2026-25253
cvss: 8.8
severity: high
source_domain: depthfirst.com
source_url: "https://depthfirst.com/research/1-click-rce-to-steal-your-moltbot-data-and-keys"
published_at: "2026-02-01T00:00:00Z"
tags: ["ai-security", "rce", "exploit-chain", "ai-assistant", "openclaw", "cve-2026-25253", "token-exfiltration"]
phying_url: "https://phying.com/item/5439"
lang: en
---

# 1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253)

## Summary

A 1-click RCE chain against OpenClaw, the open-source AI assistant: a gatewayUrl settings flaw plus a WebSocket pivot turn one malicious page visit into token theft and command execution.

## Intelligence Metadata

- **Sources:** depthfirst.com
- **CVE:** CVE-2026-25253
- **CVSS:** 8.8
- **Published:** 2026-02-01T00:00:00Z
- **Original:** https://depthfirst.com/research/1-click-rce-to-steal-your-moltbot-data-and-keys
- **Phying News:** https://phying.com/item/5439