TL;DR
On July 12, 2026, we take stock of OpenClaw’s transformation from “productivity god-send” to “security black hole” over the past four months. OpenClaw has disclosed 3 unauthenticated Remote Code Execution (RCE) high-risk CVEs (CVE-2026-30741 CVSS 9.8 / CVE-2026-32920 CVSS 9.2 / CVE-2026-25253 CVSS 8.8), China’s National Internet Emergency Center (CNCERT) issued a 4-category risk warning in March, and public-facing instances exceeded 40,000 by end of April. Meanwhile, OpenClaw v2026.5.28 (May 31) and v2026.6.11 stable (verified July 9) have shipped core fixes. This article provides a 6-step enterprise/personal defense checklist, a 4-vector attack surface map, and 5 selection pitfalls.
1. Today’s Headline: OpenClaw Security Risks Explode
OpenClaw — the open-source AI agent (nicknamed “lobster”) with 300K+ GitHub Stars — built its reputation on “local-first, data never leaves your device, natural-language computer control.” But “local” does not equal “secure.” Over the past four months, the security community has piled up disclosures:
| Date | Event | Source |
|---|---|---|
| 2026-03-10 | China’s CNCERT publishes OpenClaw security risk advisory | html5.qq.com reprint of CNCERT notice |
| 2026-03-21 | GitHub phishing: fake “OpenClaw Foundation” CLAW airdrop to token-claw.xyz | GitHub Issue #49836 + HN discussion |
| 2026-03-22 | composio.dev long-read “OpenClaw is a security nightmare dressed up as a daydream” | HN 391 pts, 275 comments |
| 2026-04-26 | OpenClaw ecosystem daily: v2026.4.24 ships Google Meet plugin + DeepSeek V4 support | duanyytop/agents-radar Issue #779 |
| 2026-05-06 | Full technical disclosure of 3 critical RCE CVEs | CSDN 2501_94650405 |
| 2026-05-31 | OpenClaw v2026.5.28: hardened Agent recovery + channel security | CSDN weixin_48502062 |
| 2026-06-07 | v2026.6.5-beta.2: QQBot strips model thinking, fixes MCP tool rich-resource RCE | GitHub Release v2026.6.5-beta.2 |
| 2026-06-08 | CSDN long-read: full OpenClaw security analysis + 40,000 public-facing instances | CSDN toprouter/160366140 |
| 2026-07-09 | OpenClaw v2026.6.11 stable verified by community | indev.cn tutorial |
| 2026-07-12 | Tencent Cloud “Warning! OpenClaw security vulnerabilities are attacking your system” | cloud.tencent.com/2645333 |
One-liner: OpenClaw’s explosive growth has outpaced its security-model iteration speed.
2. Three Critical RCE CVEs — Full Technical Portrait
From CSDN technical analysis (May 6), all three CVEs are “no strong auth + no complex interaction required” — extreme risk to production:
2.1 CVE Summary Table
| CVE ID | Type | CVSS 3.1 | Affected Versions | Core Impact |
|---|---|---|---|---|
| CVE-2026-30741 | Request-stream injection → RCE | 9.8 (Critical) | v2026.2.6 and earlier | Unauthenticated RCE, full host takeover |
| CVE-2026-32920 | Workspace plugin auto-load → command execution | 9.2 (Critical) | v2026.3.1 and earlier | Malicious plugin auto-loads without validation, persistent control |
| CVE-2026-25253 | Cross-site WebSocket hijack → RCE | 8.8 (High) | v2026.1.2 and earlier | Phishing-based credential theft, arbitrary command execution |
2.2 CVE-2026-30741 (CVSS 9.8 — Highest Risk)
- Vulnerability: OpenClaw does not validate upstream API request integrity. Attackers can craft malicious requests to “poison” the request stream, bypass security limits, inject executable code logic, induce the AI model to generate unauthorized shell commands, and execute them automatically through the MCP toolchain.
- Exploitation barrier: No authentication, no user interaction — full remote host takeover.
- Impact: All services running v2026.2.6 or earlier and exposed to the network.
2.3 CVE-2026-32920 (CVSS 9.2)
- Vulnerability: OpenClaw workspace Skills/plugin loading lacks integrity validation. Once an attacker delivers a malicious plugin, it auto-loads without security review — enabling persistent control.
- Distinguishing harm: Unlike CVE-2026-30741’s “one-shot RCE,” this vulnerability allows long-term dormancy — malicious code activates every time Skills start.
2.4 CVE-2026-25253 (CVSS 8.8)
- Vulnerability: WebSocket connections lack source validation. Attackers can steal the Agent gateway token via malicious web pages, achieving full Agent takeover.
- Typical scenario: User visits a web page with planted malicious code → Agent’s WebSocket token leaks → attacker executes arbitrary commands remotely.
3. CNCERT’s 4-Category Risk Warning
CNCERT’s March 2026 security advisory lists 4 systemic risks facing OpenClaw (reprinted by html5.qq.com):
3.1 Risk A: Exposure & Leakage
- Typical scenario: Enterprises expose OpenClaw gateway directly to the public network for convenience, with unencrypted API keys in config.
- Scale: Public-facing instances exceeded 40,000 by end of April (CSDN June 8).
- CNCERT red line: Never expose core services directly to the public network; mandatory firewall + VPN access control; periodic API key rotation + encrypted storage.
3.2 Risk B: Privilege & Injection
- Typical scenario: Attackers gain excessive privileges or craft malicious prompts to execute unauthorized operations, potentially controlling the entire system.
- CNCERT red line: Principle of least privilege; human confirmation for high-risk operations; prompt-injection audit logs.
3.3 Risk C: Misoperation
- Typical scenario: Misunderstanding user intent may lead to irreversible deletion of emails, core production data.
- CNCERT red line: Two-factor confirmation for critical operations + sandbox rollback capability.
3.4 Risk D: Skills (Plugin) Poisoning
- Typical scenario: Multiple OpenClaw Skills have been confirmed as malicious or potentially risky — installation can execute key theft, deploy trojans/backdoors, turning devices into “zombies.”
- CNCERT red line: Only install official/trusted Skills; enable openclaw-credential-manager and similar key-management tools.
4. Four-Vector Attack Surface Map
| Vector | Technique | Case |
|---|---|---|
| Prompt Injection | Hidden instructions in web pages/emails/docs | CVE-2026-30741 auto-execution via MCP toolchain |
| Plugin Sandbox Escape | Malicious Skills break sandbox boundary | CVE-2026-32920 persistent dormancy |
| WebSocket Credential Hijack | Cross-site gateway token theft | CVE-2026-25253 phishing page theft |
| Supply Chain Phishing | Fake “OpenClaw Foundation” airdrop links | token-claw.xyz phishing (2026-03-21) |
Supply-chain phishing is the most deceptive — attackers scraped GitHub stargazers/contributors and targeted OpenClaw ecosystem developers with precision.
5. 6-Step Enterprise/Personal Defense Checklist
5.1 Version Upgrade (Most Critical)
- ✅ Upgrade to v2026.6.11 stable (community-verified July 9), or minimum v2026.5.28
- ✅ Subscribe to GitHub Release Watch — evaluate CVE advisories within 24 hours
- ✅ Disable auto-upgrade for versions older than v2026.4.24 (prevent beta channel poisoning)
5.2 Network Isolation
- ✅ Never expose OpenClaw gateway directly to the public network (CNCERT red line)
- ✅ Enable firewall + VPN/Zero Trust access control
- ✅ Monitor public-facing instance count (target < 100)
5.3 Credential Management
- ✅ Install openclaw-credential-manager (GPG-encrypted API keys)
- ✅ Rotate API keys every 90 days
- ✅ Use API model aggregation platforms (keys never enter OpenClaw config files)
5.4 Plugin Governance
- ✅ Only install official/trusted Skills (CNCERT red line)
- ✅ Sandbox dry-run + behavior audit before activating any Skill
- ✅ Block Skills from suspicious domains (e.g., token-claw.xyz)
5.5 Privilege Convergence
- ✅ Principle of least privilege (each Skill gets only required permissions)
- ✅ Human confirmation for high-risk operations (file delete, shell exec, email send)
- ✅ Full operation-log audit (meets financial/government/medical compliance)
5.6 Incident Response
- ✅ Define OpenClaw compromise playbook (disconnect → rotate credentials → version rollback)
- ✅ Subscribe to CNCERT/CVE bulletins
- ✅ Quarterly red/blue team drill
6. 5 Selection Pitfalls for Enterprises Evaluating OpenClaw
| Pitfall | Wrong Approach | Right Approach |
|---|---|---|
| Deployment location | Direct public IP | Internal VPN + reverse proxy |
| API key storage | Plaintext in config.yaml | Encrypted + periodic rotation |
| Skills source | Install any GitHub Skill | Only clawhub official/trusted |
| Privilege model | Default full permission | Least privilege + 2FA |
| Upgrade strategy | Never upgrade | Follow stable releases (monthly) |
7. FAQ
Q1: Can I still use OpenClaw? Should I stop? A: Don’t stop, but you must upgrade to v2026.6.11 stable and complete all 6 checklist steps. v2026.5.28+ fixes the 3 critical RCE CVEs, and v2026.6.11 is the most community-validated version.
Q2: Is local deployment inherently secure? A: No. Local deployment solves “data never leaves device” but does NOT solve “public exposure + Skills poisoning + prompt injection.” Of CNCERT’s 4 risk categories, 3 are unrelated to local deployment — the attack surface is the Agent gateway, Skills loading, and WebSocket connections.
Q3: Does CVE-2026-30741 affect my version? How do I check?
A: Run openclaw --version in the CLI. v2026.2.6 and earlier are all affected — upgrade to v2026.6.11 immediately.
Q4: What is openclaw-credential-manager? A: An official/community open-source centralized credential management tool that GPG-encrypts all API keys, preventing plaintext leakage. It is “infrastructure-grade” defense tooling — strongly recommended for all production environments.
Q5: Is token-claw.xyz legitimate? A: It is a phishing site. On 2026-03-21, attackers impersonated “OpenClaw Foundation” and mass-emailed CLAW token airdrop links to token-claw.xyz wallet-connect pages. Do not connect your wallet.
8. Key Terms
- OpenClaw: Open-source local AI agent framework, nicknamed “lobster,” 300K+ GitHub Stars
- CNCERT: China’s National Internet Emergency Center — coordinates national cybersecurity incident response
- RCE (Remote Code Execution): A vulnerability class allowing attackers to execute arbitrary commands on target systems
- CVSS (Common Vulnerability Scoring System): 0–10 scoring system; higher score = more dangerous
- Skills (Plugins): OpenClaw’s extension modules for specific tasks (install with caution)
- MCP (Model Context Protocol): The toolchain protocol OpenClaw uses to call external tools
- WebSocket Hijack: Attack technique stealing credentials via unvalidated WebSocket connections
- Skills Poisoning: Attack method of embedding malicious code in third-party Skills
9. References
- China CNCERT OpenClaw Security Risk Advisory, 2026-03-10, html5.qq.com
- composio.dev long-read “OpenClaw is a security nightmare dressed up as a daydream”, 2026-03-22, HN 391 pts
- GitHub Issue #49836 (token-claw.xyz phishing attack), 2026-03-21
- OpenClaw Ecosystem Daily 2026-W13 / 2026-04-26, duanyytop/agents-radar Issue #779
- OpenClaw Three Critical RCE Vulnerabilities Full Analysis, CSDN 2501_94650405, 2026-05-06
- openclaw v2026.5.28 release notes, CSDN weixin_48502062, 2026-05-31
- Release openclaw 2026.6.5-beta.2, GitHub openclaw/openclaw, 2026-06-07
- OpenClaw Security Risk Comprehensive Analysis, CSDN toprouter/160366140, 2026-06-08
- OpenClaw v2026.6.11 stable (community-verified), indev.cn tutorial, 2026-07-09
- Warning! OpenClaw security vulnerabilities are attacking your system, cloud.tencent.com/2645333, 2026-07-12