{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0421",
  "aliases": [
    "CVE-2026-25253"
  ],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "OpenClaw Control UI PoC exfiltrates a gateway token",
  "details": "## What\n\nCVE-2026-25253 has a public one-click RCE chain through the OpenClaw Control UI and gatewayUrl token handling. The cited exposure census reported many reachable instances, but the research did not find a confirmed victim for this specific CVE. The status is therefore weaponised-poc.\n\n## Which configuration is exposed\n\nThe exposed setup is OpenClaw below 2026.1.29 with a reachable Control UI. A public UI and a vulnerable gatewayUrl handling path combine the version and exposure conditions; an unexposed local UI is outside the configuration.\n\n## How ACVE detects it\n\nACVE matches harness id and version plus the discovered Control UI reachability feature. It does not send the PoC, retrieve tokens, or infer public reachability from a hostname. Missing reachability is possible.\n\n## Fix\n\nUpgrade to 2026.1.29 or later, bind Control UI to loopback or an authenticated proxy, and rotate gateway tokens after any exposure. Review browser history and network logs for PoC-like requests.\n\n## Grounding needed\n\nThe GitHub PoC and NVD entry should be checked for the fixed version and exploit mechanics. Exposure counts are retained as telemetry and not promoted to an exploited-itw status.\n\nThis record is limited to the condition named in the public source: OpenClaw Control UI PoC exfiltrates a gateway token. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "openclaw"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.1.29"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "exposed-surface",
        "auth-bypass",
        "data-exfiltration"
      ],
      "cwe": [
        "CWE-306"
      ],
      "exploitation": {
        "status": "weaponised-poc",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://github.com/EQSTLab/CVE-2026-25253",
            "type": "bounty"
          },
          {
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25253",
            "type": "research"
          }
        ],
        "kev": {
          "listed": false
        },
        "victims": {
          "range": "no confirmed victim found; approximately 135,000 exposed instances reported",
          "sectors": [
            "technology"
          ],
          "evidence": "The public PoC and exposure census document weaponisation and reachable targets, not a confirmed compromise."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "cve-aliased",
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "openclaw"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<2026.1.29"
          },
          {
            "field": "features[\"controlUI.reachable\"]",
            "op": "eq",
            "value": true
          }
        ]
      },
      "fix": {
        "summary": "Upgrade OpenClaw to 2026.1.29 or later and keep Control UI private.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:openclaw",
            "to": "2026.1.29",
            "why": "Use the fixed release."
          },
          {
            "type": "reconfigure",
            "target": "features[\"controlUI.reachable\"]",
            "to": "false",
            "why": "Remove public UI exposure."
          }
        ]
      },
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:33Z",
          "sources": [
            {
              "url": "https://github.com/EQSTLab/CVE-2026-25253",
              "status": 200,
              "contentType": "text/html; charset=utf-8",
              "sha256": "sha256:687dbce028824c8546b5c9687b1e8b3d9ea903a033305e628653d20a3d6bafbe",
              "type": "bounty"
            },
            {
              "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25253",
              "status": 200,
              "contentType": "text/html",
              "sha256": "sha256:9f3939b6ce9aa986a2e444d56f8aea44b929592363f4c9884c6f9fb05d6c21f4",
              "type": "research"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}