OpenClaw 控制界面无条件信任链接里的 gatewayUrl 参数：点开恶意链接即送出网关认证 token，可一键接管本地网关（CVE-2026-25253，CVSS 8.8）。 一句话（英）：OpenClaw's Control UI trusted the gatewayUrl link parameter without validation: one click on a crafted link exfiltrated the gateway token and handed over the local gateway (CVE-2026-25253, CVSS 8.8).OpenClaw's Control UI trusted the gatewayUrl link parameter without validation: one click on a crafted link exfiltrated the gateway token and handed over the local gateway (CVE-2026-25253, CVSS 8.8).

The Control UI of OpenClaw (formerly Clawdbot and Moltbot) trusted the gatewayUrl parameter taken from a link's query string without validation. When a user clicked an attacker crafted link or visited a malicious site, the UI auto-connected to the attacker supplied address over WebSocket and sent the locally stored gateway authentication token in the connect payload. With the token, an attacker could connect to the victim's local gateway, modify configuration (sandbox and tool policies) and invoke privileged actions, executing arbitrary commands on the gateway host: a one click remote code execution. Binding the instance to loopback only did not protect it, because the victim's own browser initiated the outbound connection. All versions before 2026.1.29 were affected; severity is CVSS 8.8 (the advisory's structured fields, checked against the NVD score and verbatim quotations by several vendors). The fixed version, 2026.1.29, added a user confirmation step before the UI loads a new gatewayUrl; it shipped quietly at the end of January 2026 (sources give dates between January 29 and 31, so this entry anchors on the version number). The advisory was published on February 2, 2026, with media disclosure on February 3 (SecurityWeek). The version that introduced the flaw is not recorded in the advisory. The finder was depthfirst, whose analysis post is listed as a reference on the advisory page. OpenClaw has published no separate announcement prose.

An access control layer failure, located at the gateway gate: the gateway's connection target was decided by an external link parameter, and the connection credential travelled with the connection automatically, tying "who do I connect to" and "who gets my key" into a single unconfirmed action. External input crossed the gateway trust boundary with no validation and no confirmation step. The failure point differs from INC-048 in the same ecosystem (marketplace poisoning, tool layer), so the two are not merged. Grade note: the mechanism, impact and fix were read directly on the advisory page and checked item by item; the CVSS score and version boundary come from the advisory's structured fields, cross-checked against verbatim quotations by several vendors.

Confirm the connection target：when a gateway address comes from outside input, validate it and get user confirmation before connecting.

Credentials do not travel automatically：sending the token must be bound to a validated target; one click must not hand over the key.

Loopback binding is not a boundary：an outbound connection initiated by the victim's own browser defeats the local-only assumption.