High · published February 1, 2026
⚡ An automatic WebSocket connection is just waiting to be hijacked! OpenClaw versions prior to 2026.1.29 blindly connect to the gateway URL in the query string without a prompt — that's like giving a stranger the key to your live-streaming room! Think of it like a bartender who unknowingly accepts any drink order without checking the ID of the person making the order — you might end up serving drinks to someone who shouldn't be there! This vulnerability could allow an attacker to intercept sensitive token values being sent over the WebSocket connection. With this information, they could potentially take control of the session, manipulate data, or even execute commands in your system — absolutely devastating!
Think of it like a bartender who unknowingly accepts any drink order without checking the ID of the person making the order — you might end up serving drinks to someone who shouldn't be there! The flaw stems from OpenClaw obtaining a `gatewayUrl` from the query string and establishing a WebSocket connection without user intervention, making it vulnerable to session hijacking.
This vulnerability could allow an attacker to intercept sensitive token values being sent over the WebSocket connection. With this information, they could potentially take control of the session, manipulate data, or even execute commands in your system — absolutely devastating! To secure your application, update OpenClaw to version 2026.1.29 or later immediately. Additionally, review how gateway URLs are handled, and implement measures to validate and sanitize these inputs to prevent automatic connections. 🛡️ You've got this! Follow these steps, and you'll fortify your defenses in no time! 🔒