GoPlus Security 🚦 (@GoPlusSecurity): 🦞 #OpenClaw Gateway has a critical vulnerability. Please upgrade to version 2026.2.25 or later immediately.
Estimated coin impact
Scores are not price-change percentages. High impact means a score of +70 or more, or -70 or less.
Impact unavailable
🦞 #OpenClaw Gateway has a critical vulnerability. Please upgrade to version 2026.2.25 or later immediately. OpenClaw operates through a WebSocket Gateway bound to localhost. This Gateway serves as the core coordination layer of the Agent and is a critical component of OpenClaw. The attack specifically targets weaknesses at the Gateway layer and requires only one condition: the user visits a malicious website controlled by an attacker in their browser. Full Attack Chain: -The victim visits a malicious website controlled by the attacker in their browser; -JavaScript on the page initiates a WebSocket connection to the OpenClaw Gateway running on localhost; -The attack script attempts to brute-force the Gateway password hundreds of times per second; -Once successful, the script silently registers itself as a trusted device; -The attacker gains administrator-level control of the Agent. Security Recommendations: Upgrade immediately to OpenClaw version 2026.2.25 or later; Audit and revoke any unnecessary credentials, API keys, and node permissions granted to Agent instances. Proof of concept / exploit demonstration below 👇 https://www.youtube.com/watch?v=A15fuHs7fOc