AI agent vulnerability · OpenClaw

CVE-2026-25593: OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply

highCVSS 3.1 8.4GHSA-g55j-c2v4-pjcg

Summary An unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. Impact A local process on the same machine could execute arbitrary commands as the gateway process user.

Published Feb 4, 2026 · Updated Feb 6, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.1.20
Fixed in: 2026.1.20
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

An unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user.

Impact

A local process on the same machine could execute arbitrary commands as the gateway process user.

Details

config.apply accepted raw JSON and wrote it to disk after schema validation.
cliPath values were not constrained to safe executable names/paths.
Command discovery used a shell invocation when resolving executables.

Mitigation

Upgrade to a patched release. If projects cannot upgrade immediately, set gateway.auth and avoid custom cliPath values.

Credited to hackerman70000.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries