GoPlus: OpenClaw Gateway has a high-severity vulnerability. Please upgrade immediately to version 2026.2.25 or higher.

2026-03-02 09:29:37

Abstract generation in progress

ChainCatcher message: GoPlus Chinese community issues an early warning. OpenClaw Gateway currently has a high-severity vulnerability. Please upgrade immediately to version 2026.2.25 or higher, audit, and revoke unnecessary credentials, API keys, and node permissions granted to Agent instances.

Analysis indicates that OpenClaw runs via a WebSocket Gateway bound to the localhost. This Gateway serves as the core coordination layer for the Agent and is a critical component of OpenClaw. The attack targets the weakness in the Gateway layer, requiring only one condition: the user visits a malicious website controlled by hackers in their browser.

The complete attack chain is as follows: 1. The victim visits a malicious website controlled by the attacker in their browser; 2. JavaScript on the page initiates a WebSocket connection to the OpenClaw Gateway on the localhost; 3. The attack script then attempts to brute-force the gateway password hundreds of times per second; 4. Upon success, the script silently registers as a trusted device; 5. The attacker gains administrator-level control over the Agent.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.