orcarouter.ai

OpenClaw Control UI WebSocket hijack: one link to RCE

OpenClaw's Control UI trusted a gatewayUrl parameter, leaked the stored gateway token, and gave a malicious link remote code ...