{"id":38970,"date":"2026-03-19T08:42:44","date_gmt":"2026-03-19T08:42:44","guid":{"rendered":"https:\/\/fidelissecurity.com\/?post_type=vulnerabilities&#038;p=38970"},"modified":"2026-03-21T08:45:13","modified_gmt":"2026-03-21T08:45:13","slug":"cve-2026-25593","status":"publish","type":"vulnerabilities","link":"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-25593\/","title":{"rendered":"CVE-2026-25593"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"38970\" class=\"elementor elementor-38970\" data-elementor-settings=\"{&quot;ha_cmc_init_switcher&quot;:&quot;no&quot;}\" data-elementor-post-type=\"vulnerabilities\">\n\t\t\t\t<div class=\"elementor-element elementor-element-10f184a e-ecs-flex e-flex e-con-boxed e-con e-parent\" data-id=\"10f184a\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ecs_container_type&quot;:&quot;flex&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0e2ebbc elementor-widget elementor-widget-heading\" data-id=\"0e2ebbc\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"summary\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Summary<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0352243 elementor-widget elementor-widget-text-editor\" data-id=\"0352243\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>CVE-2026-25593 is a high-severity vulnerability in OpenClaw that allows unauthenticated local attackers to execute code through the Gateway WebSocket API. Before version 2026.1.20, the config.apply endpoint accepted unsafe cliPath values, enabling attackers to run arbitrary commands with gateway user privileges.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0b3f860 elementor-widget elementor-widget-heading\" data-id=\"0b3f860\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"actions-required\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Urgent Actions Required<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8e58d2d elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"8e58d2d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-check-square\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Upgrade OpenClaw to version 2026.1.20 or later immediately to <a href=\"https:\/\/fidelissecurity.com\/use-case\/automated-vulnerability-remediation\/\">remediate the vulnerability<\/a>.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-check-square\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Restrict local access to systems running OpenClaw to authorized users only until the patch is applied.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-check-square\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Review and validate current OpenClaw configurations for any unsafe cliPath values.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-check-square\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Monitor Gateway WebSocket API activity for unauthorized or suspicious config.apply requests.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-431855e e-ecs-flex e-flex e-con-boxed e-con e-parent\" data-id=\"431855e\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ecs_container_type&quot;:&quot;flex&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e6059c5 elementor-widget elementor-widget-heading\" data-id=\"e6059c5\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"vulnerable-systems\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Which Systems Are Vulnerable to\u202fCVE-2026-25593?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-91f5818 elementor-widget elementor-widget-heading\" data-id=\"91f5818\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Technical Overview<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d261fe2 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"d261fe2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Vulnerability Type:<\/b>\u202fUnauthenticated Local Remote Code Execution via <i>WebSocket config.apply<\/i><\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Affected Software\/Versions:<\/b> <br> OpenClaw versions prior to 2026.1.20<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>CVSS Vector:\u202fv3.1<\/b> <ul> <li>Attack Vector: Local<\/li> <li>Attack Complexity: Low<\/li> <li>Privileges Required: None<\/li> <li>User Interaction: None<\/li> <li>Scope: Unchanged<\/li> <li>Confidentiality Impact: High<\/li> <li>Integrity Impact: High<\/li> <li>Availability Impact: High<\/li> <\/ul><\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Patch Availability:<\/b>\u202fYes, available<br><a href=\"https:\/\/github.com\/openclaw\/openclaw\/security\/advisories\/GHSA-g55j-c2v4-pjcg\" target=\"_blank\" rel=\"noopener nofollow noreferrer\">Unauthenticated Local RCE via WebSocket config.apply \u00b7 Advisory \u00b7 openclaw\/openclaw \u00b7 GitHub<\/a><\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-496d048 e-ecs-flex e-flex e-con-boxed e-con e-parent\" data-id=\"496d048\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ecs_container_type&quot;:&quot;flex&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-759b53d elementor-widget elementor-widget-heading\" data-id=\"759b53d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Does the\u202fCVE-2026-25593 Exploit Work?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0e9e9cb elementor-widget elementor-widget-text-editor\" data-id=\"0e9e9cb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The attack typically follows these steps:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2b05bab elementor-widget elementor-widget-image\" data-id=\"2b05bab\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"1000\" height=\"815\" src=\"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593.webp\" class=\"attachment-full size-full wp-image-38971\" alt=\"CVE-2026-25593\" srcset=\"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593.webp 1000w, https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593-300x245.webp 300w, https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593-768x626.webp 768w\" sizes=\"(max-width: 1000px) 100vw, 1000px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a93a1eb elementor-widget elementor-widget-heading\" data-id=\"a93a1eb\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"mitigate\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Causes\u202fCVE-2026-25593?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7275c12 elementor-widget elementor-widget-text-editor\" data-id=\"7275c12\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Vulnerability Root Cause:<\/strong><\/p><p>CVE-2026-25593 is caused by OpenClaw\u2019s config.apply WebSocket API accepting configuration input without authentication and insufficiently validating cliPath values. This allows a local client to inject commands that are executed by the gateway process, leading to unauthenticated local <a href=\"https:\/\/fidelissecurity.com\/cybersecurity-101\/cyberattacks\/remote-code-execution-rce\/\">remote code execution<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e1e32da elementor-widget elementor-widget-heading\" data-id=\"e1e32da\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Can You Mitigate\u202fCVE-2026-25593?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4f81845 elementor-widget elementor-widget-text-editor\" data-id=\"4f81845\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em><strong>If immediate patching is delayed or not possible:<\/strong><\/em><\/p><ul><li>Restrict access to the OpenClaw WebSocket API from untrusted local users or processes.<\/li><li>Run OpenClaw in a containerized or isolated environment with minimal privileges.<\/li><li>Disable the config.apply functionality if it is not essential to operations.<\/li><li>Validate configuration inputs to ensure cliPath values do not reference unsafe executables.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-048e63e elementor-widget elementor-widget-heading\" data-id=\"048e63e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Which Assets and Systems Are at Risk?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a622920 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"a622920\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Asset Types Affected:<\/b> <ul> <li>OpenClaw Deployments - Systems running OpenClaw versions earlier than 2026.1.20.<\/li> <li>Local AI Agent Environments - Developer machines or systems where the OpenClaw gateway and its WebSocket API are active.<\/li> <\/ul><\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Exposure Level:<\/b> <br> Local environments where an unauthenticated client can access the OpenClaw WebSocket API.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3474d9c elementor-widget elementor-widget-heading\" data-id=\"3474d9c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Will Patching\u202fCVE-2026-25593 Cause Downtime?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-20b1149 elementor-widget elementor-widget-text-editor\" data-id=\"20b1149\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Patch application impact:<\/strong>\u202fLow. Update OpenClaw to 2026.1.20 or later; minimal downtime expected.<\/p><p><strong>Mitigation (if immediate patching is not possible):<\/strong>\u202fRestrict WebSocket access to trusted users and disable config.apply if not needed. Full protection requires applying the patch.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ca566b1 elementor-widget elementor-widget-heading\" data-id=\"ca566b1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How Can You Detect\u202fCVE-2026-25593 Exploitation?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3af05b1 elementor-widget elementor-widget-heading\" data-id=\"3af05b1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Exploitation Signatures:<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a539b10 elementor-widget elementor-widget-text-editor\" data-id=\"a539b10\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Look for attempts to use the OpenClaw Gateway WebSocket API to invoke config.apply with unusual or unsafe cliPath values. Repeated or unexpected config writes may indicate an active exploitation attempt.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-221fc5e elementor-widget elementor-widget-heading\" data-id=\"221fc5e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Indicators of Compromise (IOCs\/IOAs):<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f737893 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"f737893\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Unauthorized modifications to gateway configuration via WebSocket.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Unexpected command execution as the gateway user.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Attempts to write unsafe cliPath values. <\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dcbae36 elementor-widget elementor-widget-heading\" data-id=\"dcbae36\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Behavioral\u202fIndicators:\u202f<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a186984 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"a186984\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Config changes occurring without authenticated local access.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Gateway executing commands derived from malicious config entries.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9a751ff elementor-widget elementor-widget-heading\" data-id=\"9a751ff\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Alerting Strategy:<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2280585 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"2280585\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Priority:<\/b> Critical<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Trigger alerts for:<\/b><br> Repeated or suspicious config.apply requests from local clients.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1ccf3cc elementor-widget elementor-widget-heading\" data-id=\"1ccf3cc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Remediation &amp; Response<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-839aa54 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"839aa54\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Rollback Plan:<\/b> <br>If issues occur after upgrading, revert to the previous deployment configuration while restricting access to the OpenClaw WebSocket API until the update can be reapplied.<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-long-arrow-alt-right\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><b>Incident Response Considerations:<\/b> <ul> <li>Review gateway configuration changes made through the WebSocket API.<\/li> <li>Investigate for any unauthorized configuration updates involving config.apply or suspicious cliPath values.<\/li> <li>Apply the fixed version and monitor for further attempts to modify the gateway configuration.<\/li> <\/ul><\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-89a7de5 elementor-widget elementor-widget-heading\" data-id=\"89a7de5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">CVSS Breakdown Table<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cd4f8e0 elementor-widget elementor-widget-Table\" data-id=\"cd4f8e0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"Table.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<table class=\"tafe-table \">\n\t\t\t<thead  class=\"tafe-table-header\">\n\t\t\t\t<tr>\n\t\t\t\t\t<th class=\"elementor-inline-editing elementor-repeater-item-58d4a4b\"   >Metric<\/th><th class=\"elementor-inline-editing elementor-repeater-item-5df925d\"   >Value\u202f<\/th><th class=\"elementor-inline-editing elementor-repeater-item-1a6f993\"   >Description<\/th>\t\t\t\t<\/tr>\n\t\t\t<\/thead>\n\t\t\t\t\t\t<tbody class=\"tafe-table-body\">\n\t\t\t\t<tr>\n\t\t\t\t\t<td data-label=\"Metric\"   class=\"elementor-repeater-item-480a869 td-content-type-default\" >Base Score<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-ff1827d td-content-type-default\" >8.4<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-5024640 td-content-type-default\" >High-severity vulnerability that can allow command execution through the OpenClaw gateway<\/td><\/tr><tr><td data-label=\"Metric\"   class=\"elementor-repeater-item-f8ff5e5 td-content-type-default\" >Attack Vector\u202f<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-aa5725f td-content-type-default\" >Local<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-5bb61e1 td-content-type-default\" >The attack requires access from a local client interacting with the gateway\u2019s WebSocket API<\/td><\/tr><tr><td data-label=\"Metric\"   class=\"elementor-repeater-item-030713e td-content-type-default\" >Attack Complexity<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-536a741 td-content-type-default\" >Low<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-525cf00 td-content-type-default\" >Exploitation does not require complex conditions once local access is available<\/td><\/tr><tr><td data-label=\"Metric\"   class=\"elementor-repeater-item-1a6ec90 td-content-type-default\" >Privileges Required<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-746fafa td-content-type-default\" >None<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-964ffd5 td-content-type-default\" >The vulnerability can be triggered without authentication<\/td><\/tr><tr><td data-label=\"Metric\"   class=\"elementor-repeater-item-883e32a td-content-type-default\" >User Interaction<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-393cf75 td-content-type-default\" >None<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-de278eb td-content-type-default\" >No user action is needed for the attack to succeed<\/td><\/tr><tr><td data-label=\"Metric\"   class=\"elementor-repeater-item-730f8ea td-content-type-default\" >Scope<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-7b4897e td-content-type-default\" >UnChanged<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-05c0140 td-content-type-default\" >The impact remains within the vulnerable OpenClaw component<\/td><\/tr><tr><td data-label=\"Metric\"   class=\"elementor-repeater-item-3468069 td-content-type-default\" >Confidentiality Impact\u202f<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-e24e68c td-content-type-default\" >High<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-87bdd5c td-content-type-default\" >Successful exploitation may expose configuration data or system information<\/td><\/tr><tr><td data-label=\"Metric\"   class=\"elementor-repeater-item-3a4d50d td-content-type-default\" >Integrity Impact<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-aa0e796 td-content-type-default\" >High<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-9904f75 td-content-type-default\" >Attackers can modify the configuration and execute commands as the gateway user<\/td><\/tr><tr><td data-label=\"Metric\"   class=\"elementor-repeater-item-22028b6 td-content-type-default\" >Availability Impact<\/td><td data-label=\"Value\u202f\"   class=\"elementor-repeater-item-b8cee82 td-content-type-default\" >High<\/td><td data-label=\"Description\"   class=\"elementor-repeater-item-703b496 td-content-type-default\" >Command execution could disrupt or affect the operation of the gateway<\/td>\t\t\t\t<\/tr>\n\t\t\t<\/tbody>\n\t\t<\/table>\n\t\t\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a7a3f49 e-ecs-flex e-flex e-con-boxed e-con e-parent\" data-id=\"a7a3f49\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ecs_container_type&quot;:&quot;flex&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f5dcd9e keepExploring elementor-widget elementor-widget-related_posts\" data-id=\"f5dcd9e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"related_posts.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t        <div id=\"widget-related-posts\" class=\"related-posts-widget-wrapper\">\r\n            <div class=\"related-posts-wrapper\">\r\n\r\n                                    <h3>Keep Exploring<\/h3>\r\n                \r\n                                    <p>Detailed insights into critical and emerging CVEs<\/p>\r\n                \r\n                <div class=\"ecs-posts elementor-posts-container elementor-posts\"><ul class=\"related-posts-list\" style=\"list-style:none;padding:0;\"><li style=\"margin-bottom:10px;\"><a href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-44756\/\">CVE-2026-44756<\/a><\/li><li style=\"margin-bottom:10px;\"><a href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-55040\/\">CVE-2026-55040<\/a><\/li><li style=\"margin-bottom:10px;\"><a href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-68820\/\">CVE-2026-68820<\/a><\/li><li style=\"margin-bottom:10px;\"><a href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-65791\/\">CVE-2026-65791<\/a><\/li><li style=\"margin-bottom:10px;\"><a href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-62878\/\">CVE-2026-62878<\/a><\/li><li style=\"margin-bottom:10px;\"><a href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-58231\/\">CVE-2026-58231<\/a><\/li><li style=\"margin-bottom:10px;\"><a href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-65400\/\">CVE-2026-65400<\/a><\/li><li style=\"margin-bottom:10px;\"><a href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-63077\/\">CVE-2026-63077<\/a><\/li><\/ul><\/div>\r\n            <\/div>\r\n        <\/div>\r\n        \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-29f0fef e-ecs-flex e-flex e-con-boxed e-con e-parent\" data-id=\"29f0fef\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ecs_container_type&quot;:&quot;flex&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fd79500 elementor-widget elementor-widget-heading\" data-id=\"fd79500\" data-element_type=\"widget\" data-e-type=\"widget\" id=\"resources\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\">References:<\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3bdf004 elementor-widget elementor-widget-text-editor\" data-id=\"3bdf004\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ol><li><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-25593\" target=\"_blank\" rel=\"noopener nofollow noreferrer\">CVE Record: CVE-2026-25593<\/a><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-25593\" target=\"_blank\" rel=\"noopener nofollow noreferrer\">NVD &#8211; CVE-2026-25593<\/a><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>CVE-2026-25593 is a high-severity OpenClaw vulnerability enabling unauthenticated local command execution via the Gateway WebSocket API. Unsafe cliPath values in config.apply allowed command injection. Updating to version 2026.1.20 or later fixes the issue.<\/p>\n","protected":false},"featured_media":38971,"template":"","severity":[1473],"vuln_year":[1524],"class_list":["post-38970","vulnerabilities","type-vulnerabilities","status-publish","has-post-thumbnail","hentry","severity-high","vuln_year-1524"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-25593: OpenClaw Command Injection | Fidelis Security<\/title>\n<meta name=\"description\" content=\"CVE-2026-25593 lets unauthenticated users execute commands via OpenClaw WebSocket API. Update to v2026.1.20+ to fix this high-severity flaw.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-25593\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-25593: OpenClaw Command Injection | Fidelis Security\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-25593 lets unauthenticated users execute commands via OpenClaw WebSocket API. Update to v2026.1.20+ to fix this high-severity flaw.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/\" \/>\n<meta property=\"og:site_name\" content=\"Fidelis Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/fideliscyber\/\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-21T08:45:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"815\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@FidelisCyber\" \/>\n<meta name=\"twitter:label1\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/vulnerabilities\\\/cve-2026-25593\\\/\",\"url\":\"https:\\\/\\\/fidelissecurity.com\\\/vulnerabilities\\\/cve-2026-25593\\\/\",\"name\":\"CVE-2026-25593: OpenClaw Command Injection | Fidelis Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/vulnerabilities\\\/cve-2026-25593\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/vulnerabilities\\\/cve-2026-25593\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/fidelissecurity.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/CVE-2026-25593.webp\",\"datePublished\":\"2026-03-19T08:42:44+00:00\",\"dateModified\":\"2026-03-21T08:45:13+00:00\",\"description\":\"CVE-2026-25593 lets unauthenticated users execute commands via OpenClaw WebSocket API. Update to v2026.1.20+ to fix this high-severity flaw.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/vulnerabilities\\\/cve-2026-25593\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/fidelissecurity.com\\\/vulnerabilities\\\/cve-2026-25593\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/vulnerabilities\\\/cve-2026-25593\\\/#primaryimage\",\"url\":\"https:\\\/\\\/fidelissecurity.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/CVE-2026-25593.webp\",\"contentUrl\":\"https:\\\/\\\/fidelissecurity.com\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/CVE-2026-25593.webp\",\"width\":1000,\"height\":815,\"caption\":\"CVE-2026-25593\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/vulnerabilities\\\/cve-2026-25593\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Vulnerabilities\",\"item\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/vulnerabilities\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"CVE-2026-25593\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/#website\",\"url\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/\",\"name\":\"Fidelis Security\",\"description\":\"Unified Threat Detection and Response Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/#organization\"},\"alternateName\":\"Fidelis\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/#organization\",\"name\":\"Fidelis Security\",\"alternateName\":\"Fidelis\",\"url\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/fidelissecurity.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/Fidelis-Security-Logo-SVG.svg\",\"contentUrl\":\"https:\\\/\\\/fidelissecurity.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/Fidelis-Security-Logo-SVG.svg\",\"width\":500,\"height\":500,\"caption\":\"Fidelis Security\"},\"image\":{\"@id\":\"https:\\\/\\\/fidelissecurity.com\\\/es\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/fideliscyber\\\/\",\"https:\\\/\\\/x.com\\\/FidelisCyber\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/fideliscybersecurity\",\"https:\\\/\\\/www.youtube.com\\\/c\\\/FidelisCybersecurity\",\"https:\\\/\\\/www.gartner.com\\\/reviews\\\/market\\\/network-detection-and-response\\\/vendor\\\/fidelis-security\",\"https:\\\/\\\/www.g2.com\\\/sellers\\\/fidelis-cybersecurity#profiles\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-25593: OpenClaw Command Injection | Fidelis Security","description":"CVE-2026-25593 lets unauthenticated users execute commands via OpenClaw WebSocket API. Update to v2026.1.20+ to fix this high-severity flaw.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-25593\/","og_locale":"es_ES","og_type":"article","og_title":"CVE-2026-25593: OpenClaw Command Injection | Fidelis Security","og_description":"CVE-2026-25593 lets unauthenticated users execute commands via OpenClaw WebSocket API. Update to v2026.1.20+ to fix this high-severity flaw.","og_url":"https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/","og_site_name":"Fidelis Security","article_publisher":"https:\/\/www.facebook.com\/fideliscyber\/","article_modified_time":"2026-03-21T08:45:13+00:00","og_image":[{"width":1000,"height":815,"url":"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593.webp","type":"image\/webp"}],"twitter_card":"summary_large_image","twitter_site":"@FidelisCyber","twitter_misc":{"Tiempo de lectura":"4 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/cve-2026-25593\/","url":"https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/","name":"CVE-2026-25593: OpenClaw Command Injection | Fidelis Security","isPartOf":{"@id":"https:\/\/fidelissecurity.com\/es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/#primaryimage"},"image":{"@id":"https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/#primaryimage"},"thumbnailUrl":"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593.webp","datePublished":"2026-03-19T08:42:44+00:00","dateModified":"2026-03-21T08:45:13+00:00","description":"CVE-2026-25593 lets unauthenticated users execute commands via OpenClaw WebSocket API. Update to v2026.1.20+ to fix this high-severity flaw.","breadcrumb":{"@id":"https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/#primaryimage","url":"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593.webp","contentUrl":"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2026\/03\/CVE-2026-25593.webp","width":1000,"height":815,"caption":"CVE-2026-25593"},{"@type":"BreadcrumbList","@id":"https:\/\/fidelissecurity.com\/vulnerabilities\/cve-2026-25593\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fidelissecurity.com\/es\/"},{"@type":"ListItem","position":2,"name":"Vulnerabilities","item":"https:\/\/fidelissecurity.com\/es\/vulnerabilities\/"},{"@type":"ListItem","position":3,"name":"CVE-2026-25593"}]},{"@type":"WebSite","@id":"https:\/\/fidelissecurity.com\/es\/#website","url":"https:\/\/fidelissecurity.com\/es\/","name":"Fidelis Security","description":"Unified Threat Detection and Response Platform","publisher":{"@id":"https:\/\/fidelissecurity.com\/es\/#organization"},"alternateName":"Fidelis","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fidelissecurity.com\/es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/fidelissecurity.com\/es\/#organization","name":"Fidelis Security","alternateName":"Fidelis","url":"https:\/\/fidelissecurity.com\/es\/","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/fidelissecurity.com\/es\/#\/schema\/logo\/image\/","url":"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2024\/08\/Fidelis-Security-Logo-SVG.svg","contentUrl":"https:\/\/fidelissecurity.com\/wp-content\/uploads\/2024\/08\/Fidelis-Security-Logo-SVG.svg","width":500,"height":500,"caption":"Fidelis Security"},"image":{"@id":"https:\/\/fidelissecurity.com\/es\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/fideliscyber\/","https:\/\/x.com\/FidelisCyber","https:\/\/www.linkedin.com\/company\/fideliscybersecurity","https:\/\/www.youtube.com\/c\/FidelisCybersecurity","https:\/\/www.gartner.com\/reviews\/market\/network-detection-and-response\/vendor\/fidelis-security","https:\/\/www.g2.com\/sellers\/fidelis-cybersecurity#profiles"]}]}},"_links":{"self":[{"href":"https:\/\/fidelissecurity.com\/es\/wp-json\/wp\/v2\/vulnerabilities\/38970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fidelissecurity.com\/es\/wp-json\/wp\/v2\/vulnerabilities"}],"about":[{"href":"https:\/\/fidelissecurity.com\/es\/wp-json\/wp\/v2\/types\/vulnerabilities"}],"version-history":[{"count":0,"href":"https:\/\/fidelissecurity.com\/es\/wp-json\/wp\/v2\/vulnerabilities\/38970\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fidelissecurity.com\/es\/wp-json\/wp\/v2\/media\/38971"}],"wp:attachment":[{"href":"https:\/\/fidelissecurity.com\/es\/wp-json\/wp\/v2\/media?parent=38970"}],"wp:term":[{"taxonomy":"severity","embeddable":true,"href":"https:\/\/fidelissecurity.com\/es\/wp-json\/wp\/v2\/severity?post=38970"},{"taxonomy":"vuln_year","embeddable":true,"href":"https:\/\/fidelissecurity.com\/es\/wp-json\/wp\/v2\/vuln_year?post=38970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}