PANews reported on March 2nd that the GoPlus Chinese community issued a warning about a high-risk vulnerability in the OpenClaw Gateway. Users are urged to immediately upgrade to version 2026.2.25 or higher and audit and revoke any unnecessary credentials, API keys, and node permissions granted to Agent instances. The analysis states that OpenClaw operates through a WebSocket Gateway bound to the local host. This Gateway, as the core coordination layer for the Agent, is a crucial component of OpenClaw. This attack targets a weakness in the Gateway layer, requiring only one condition: the user visits a malicious website controlled by the hacker in their browser.
The complete attack chain is as follows:
- 1. The victim accessed a malicious website controlled by the attacker in their browser;
- 2. The JavaScript in the page initiates a WebSocket connection to the OpenClaw gateway on the local host;
- 3. Subsequently, the attack script attempts to brute-force the gateway password hundreds of times per second;
- 4. After successful cracking, the attack script silently registers as a trusted device;
- 5. The attacker gains administrator-level control over the Agent;
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact
[email protected] for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.