OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-g55j-c2v4-pjcg | OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 06 Feb 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20. | |
| Title | OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply | |
| Weaknesses | CWE-306 CWE-78 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-02-06T20:56:02.824Z
Reserved: 2026-02-03T01:02:46.716Z
Link: CVE-2026-25593
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-02-06T21:16:17.790
Modified: 2026-02-06T21:57:22.450
Link: CVE-2026-25593
Redhat
No data.
OpenCVE Enrichment
No data.