{
  "slug": "openclaw-control-ui-exposure",
  "name": "OpenClaw Control UI exposure",
  "aliases": [
    "CVE-2026-25253"
  ],
  "status": "dormant",
  "firstSeen": "2026-02-01",
  "lastSeen": "2026-02-01",
  "lastReviewed": "2026-09-20T00:00:00Z",
  "summary": "Internet-exposed OpenClaw Control UI instances permit token exfiltration and one-click RCE.",
  "description": "A public proof of concept targeted reachable OpenClaw Control UI deployments; reporting estimated 135,000 exposed instances.",
  "platforms": [
    "internet-exposed",
    "github"
  ],
  "ttps": [
    {
      "framework": "atr",
      "id": "exposed-surface"
    }
  ],
  "timeline": [
    {
      "date": "2026-02-01",
      "branch": "exposure",
      "id": "135000-openclaw-hosts",
      "source": "https://github.com/EQSTLab/CVE-2026-25253",
      "approximate": true,
      "note": "Source gives a month or period, not a day."
    }
  ],
  "iocs": [
    {
      "type": "repo",
      "value": "CVE-2026-25253",
      "firstSeen": "2026-02-01",
      "source": "https://github.com/EQSTLab/CVE-2026-25253"
    }
  ],
  "exposedConfigurations": [
    {
      "label": "OpenClaw Control UI is reachable from an untrusted network",
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "openclaw"
          },
          {
            "field": "surface",
            "op": "in",
            "value": [
              "public",
              "internet"
            ]
          }
        ]
      }
    }
  ],
  "advisories": [
    "ACVE-2026-0421"
  ],
  "incidents": [],
  "sources": [
    {
      "url": "https://github.com/EQSTLab/CVE-2026-25253",
      "publisher": "EQSTLab",
      "date": "2026-02-01"
    }
  ],
  "dormantAfterDays": 30
}