One-click RCE vulnerability CVE-2026-25253 — CVSS 8.8 WebSocket hijacking

Critical flaw allows full machine compromise with single click. Control UI trusts gatewayUrl from query string without validation, auto-connects, sends gateway token. 40,000+ instances exposed at disclosure. Patched in v2026.1.29.

Product Idea from this Signal

A network firewall that blocks WebSocket hijack attacks on local OpenClaw agents before malicious sites connect

900 ▲

Any website can silently connect to your local OpenClaw agent via WebSocket brute-force and steal data, execute commands, or exfiltrate credentials. The ClawJacked vulnerability (85K+ virality, CVSS 8.8-9.9) affects every default OpenClaw install running on localhost. Existing patches only cover specific CVEs while new WebSocket attack vectors keep appearing weekly. This tool runs as a local proxy between the browser and the OpenClaw gateway, validating every WebSocket connection against an allowlist of trusted origins, blocking unauthorized handshakes, and logging all connection attempts for forensic review.

SECURITYCLIDEVTOOLOPEN-SOURCE

CompetitiveView Opportunity →