OpenClaw (also known as ClawdBot or MoltBot) contains a flaw where the Control UI trusts the `gatewayUrl` parameter from the query string without proper validation. Upon page load, the application automatically establishes a WebSocket connection to this URL and sends the stored gateway token in the connection payload.
An attacker can exploit this by tricking a user into clicking a specially crafted link or visiting a malicious website, which exfiltrates the token to a server controlled by the attacker. With this token, the attacker gains operator-level access to the gateway API, allowing them to modify configurations (such as sandbox and tool policies) and invoke privileged actions. This can lead to full gateway compromise and one-click remote code execution (RCE) on the host machine. The issue persists even if the gateway is configured to listen only on the loopback interface, as the victim's browser initiates the outbound connection.