DEEPWING · ENGLISH EDITION

INC-047: OpenClaw's Control UI trusted the gatewayUrl link parameter without validation: one click on a crafted link exfiltrated the gateway token and handed over the local gateway (CVE-2026-25253, CVSS 8.8). · DeepWing Case Library

DeepWing Case Library, case INC-047. Primary failure layer: Access Control. Evidence grade: Primary-source verified. What happened, why it failed, and the gate that should have caught it.

Read the English edition中文原页 · Chinese original

This page is the English sharing entry for DeepWing case INC-047. It forwards to the English edition; the canonical page is the original above.