OpenClaw (clawdbot or Moltbot) binaries older than version 2026.1.29 automatically read a gatewayUrl value from a query string and establish a WebSocket connection to that URL without user confirmation, sending an authentication token in the process. This behaviour allows a remote attacker to supply a malicious WebSocket endpoint, receive the token, and potentially exfiltrate data or execute code on the client. The flaw is a CWE‑669 error: improper validation of user input in a security‑critical operation.

The affected product is OpenClaw, shipped as OpenClaw (clawdbot or Moltbot). Only installations running a pre‑2026.1.29 release are vulnerable.

The vulnerability carries a CVSS score of 8.8, indicating a high‑severity risk, but the EPSS score is well below 1%, suggesting that real‑world exploitation is currently uncommon. The flaw is not included in the CISA KEV catalog. Attackers can trigger it by crafting a URL that includes a gatewayUrl query string pointing to a WebSocket server under their control; the victim’s client will then open the connection automatically, allowing the attacker to capture the token and communicate with the client. Because the vulnerability relies on client‑side processing of a URL, it can be triggered through social‑engineering or phishing campaigns.