ClawJacked: Critical Local Agent Hijacking

Overview

CVE-2026-27004 (ClawJacked) is a critical vulnerability that allowed malicious websites to connect to locally running OpenClaw agents and brute-force passwords without limits.

The Vulnerability

Attack Vector

• Malicious websites could connect to locally running OpenClaw instances
• Unlimited password brute-forcing possible
• Session data exposure in multi-user deployments

Impact

• Unauthorized access to agent controls
• Potential data exfiltration
• Command execution via compromised agents

Discovery

Reported by: CSO Online, The Hacker News
Date: February 28, 2026
Severity: Critical

Mitigation

Immediate Actions

1. Update to OpenClaw 2026.2.23 immediately
2. Enable optional HSTS headers on Gateway
3. Implement strong authentication on all agent endpoints

Network Security

• Never expose Gateway to open internet
• Use Tailscale/VPN for remote access
• Implement network segmentation

Authentication Hardening

• Strong, unique passwords
• Multi-factor authentication where possible
• Regular credential rotation

Prevention Best Practices

1. Network Isolation: Run agents on isolated networks
2. Access Control: Implement least-privilege access
3. Monitoring: Log all authentication attempts
4. Updates: Apply security patches immediately

References

• CSO Online (February 28, 2026)
• The Hacker News (March 1, 2026)
• OpenClaw 2026.2.23 Release Notes