135,000 OpenClaw Instances Are Exposed Right Now. Don’t Be One of Them.

Right now, as you read this, over 135,000 OpenClaw
instances are sitting on the public internet with no
authentication, no firewall, and no encryption.

That’s not a hypothetical. That’s a Shodan query anyone can run in
ten seconds.

Some of those instances are running personal automations — smart home
controls, private AI assistants, financial dashboards. Some are
connected to business APIs with real credentials baked in. And every
single one of them is reachable by anyone with a browser.

If you installed OpenClaw, got it working, and moved on with your
life — this article is for you.

We’re not here to scare you. We’re here to help you lock the door you
didn’t know was open.

Why Default
OpenClaw Installs Are Wide Open

Here’s the uncomfortable truth about openclaw security risks:
the default install prioritises convenience over
safety.

When you spin up OpenClaw for the first time, it binds to
0.0.0.0:7860 by default. That means it listens on every
network interface — including your public IP if you’re on a VPS or cloud
instance.

There’s no password. No API key requirement. No TLS.

If you’re running it on a home network behind a router, you’re
probably fine. But if you’re on a DigitalOcean droplet, an AWS
EC2 instance, or any server with a public IP? Your entire OpenClaw setup
is accessible to the world.

This isn’t a bug. It’s a design choice that makes local development
easy. The problem is that most tutorials skip the “now secure it for
production” step entirely.

And if you migrated from the older clawdbot or
moltbot projects (which OpenClaw evolved from), you
might have carried over configs that are even less secure — those early
projects had virtually no security model at all.

What’s Actually at Risk?

Let’s be specific about what an exposed OpenClaw instance leaks:

Your API keys. OpenAI, Anthropic, Google — whatever
you’ve plugged in. Visible in environment configs or inferable from the
running agents.
Your automations. Workflows, integrations,
connected services. An attacker can see what you’ve built and how it
connects.
Your data. Chat logs, uploaded files, agent memory,
personal information flowing through your pipelines.
Your compute. Someone can run their own workloads
on your instance — crypto mining, spam distribution, or worse.

This is why the
question “is OpenClaw safe?” keeps coming up. The software itself is
solid. The default deployment posture is not.

CVE-2026-25253: The Wake-Up
Call

In January 2026, CVE-2026-25253 dropped — a critical
server-side request forgery (SSRF) vulnerability in OpenClaw’s gateway
API.

The short version: an unauthenticated attacker could craft requests
through the gateway to access internal services on the host machine.
Think metadata endpoints on cloud providers
(169.254.169.254), internal databases, admin panels —
anything the server could reach.

CVSS score: 9.1 (Critical).

The fix landed in OpenClaw v2.8.3. But here’s the thing — if you’re
one of those 135,000 exposed instances, you’re probably not running the
latest version either.

What to do right now:

# Check your current version
openclaw --version

# Update to latest
openclaw update

# If you installed via Docker
docker pull openclaw/openclaw:latest
docker compose up -d

If you’re running anything below v2.8.3, stop reading and
update first. Everything else in this article is secondary to
patching a known critical CVE.

The Global Threat Context

You might be wondering: who’s actually scanning for exposed OpenClaw
instances?

Everyone.

Security researchers at GreyNoise have tracked sustained
scanning campaigns targeting OpenClaw’s default port from IP
ranges primarily based in China and South Korea. These
aren’t random port scans — they’re targeted probes looking specifically
for OpenClaw and similar AI orchestration platforms.

In late 2025, South Korea briefly restricted certain AI agent
platforms over data sovereignty concerns. China has its own regulatory
regime around AI services. The result? A thriving grey market of
“borrowed” compute — and exposed instances in Western countries are
prime targets.

This isn’t xenophobia. It’s threat intelligence. The scans are real,
the exploitation is automated, and your unsecured instance is a
commodity.

Some of these campaigns still search for the legacy
moltbot and clawdbot endpoints, which
tells you how automated and broad-spectrum the scanning is. If you ever
ran either of those projects, check that their ports are closed too.

Step 1: Lock Down the
Firewall

The single most impactful thing you can do in five minutes is stop
exposing OpenClaw to the internet directly.

On Ubuntu/Debian (UFW):

# Deny OpenClaw's default port from the internet
sudo ufw deny 7860

# Allow only from your local network (adjust range)
sudo ufw allow from 192.168.1.0/24 to any port 7860

# Allow from your Tailscale/VPN network
sudo ufw allow from 100.64.0.0/10 to any port 7860

# Verify
sudo ufw status

On CentOS/RHEL (firewalld):

# Remove public access
sudo firewall-cmd --zone=public --remove-port=7860/tcp --permanent

# Add trusted zone access
sudo firewall-cmd --zone=trusted --add-source=192.168.1.0/24 --permanent
sudo firewall-cmd --zone=trusted --add-port=7860/tcp --permanent
sudo firewall-cmd --reload

Cloud providers:

If you’re on AWS, GCP, or Azure — check your security groups
/ firewall rules in the cloud console too. Host-level firewalls
are great, but cloud-level rules are your first line of defence.

This is the foundation of any openclaw firewall setup. Everything
else builds on this.

Step 2: Put a Reverse Proxy
in Front

A reverse proxy gives you TLS encryption, authentication, rate
limiting, and logging — all without modifying OpenClaw itself.

Nginx + Let’s Encrypt (the
classic):

server {
    listen 443 ssl http2;
    server_name openclaw.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/openclaw.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/openclaw.yourdomain.com/privkey.pem;

    # Basic auth
    auth_basic "OpenClaw";
    auth_basic_user_file /etc/nginx/.htpasswd;

    location / {
        proxy_pass http://127.0.0.1:7860;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support (required for OpenClaw)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Generate the password file:

sudo apt install apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd youruser

Get your TLS cert:

sudo certbot --nginx -d openclaw.yourdomain.com

Now OpenClaw binds only to 127.0.0.1 (localhost), and
the world talks to Nginx, which handles auth and encryption.

Caddy (the easy option):

If Nginx config gives you hives, Caddy does TLS automatically:

openclaw.yourdomain.com {
    basicauth / {
        youruser $2a$14$hashgoeshere
    }
    reverse_proxy localhost:7860
}

That’s it. Caddy handles certificate provisioning, renewal, and HTTPS
redirects automatically.

Step 3: Bind to Localhost

This is easy to miss. In your OpenClaw config, change the bind
address:

# openclaw config (gateway section)
gateway:
  host: 127.0.0.1    # NOT 0.0.0.0
  port: 7860

Or if launching from CLI:

openclaw gateway start --host 127.0.0.1

This ensures OpenClaw only accepts connections from the local
machine. Combined with the reverse proxy from Step 2, external traffic
goes through Nginx/Caddy (with auth and TLS) and reaches OpenClaw via
localhost.

Step 4: Use an Encrypted
Tunnel

If a reverse proxy feels like overkill for your use case — maybe it’s
a personal instance and you just want secure remote access — an
encrypted tunnel is the fastest path.

Tailscale (recommended):

# Install on your server
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# Install on your laptop/phone
# Access OpenClaw at http://100.x.x.x:7860

Tailscale creates a WireGuard mesh VPN. Your OpenClaw instance never
touches the public internet, but you can reach it from any of your
devices. Zero config, zero exposed ports.

Cloudflare Tunnel:

cloudflared tunnel create openclaw
cloudflared tunnel route dns openclaw openclaw.yourdomain.com

# In ~/.cloudflared/config.yml
tunnel: <tunnel-id>
credentials-file: /root/.cloudflared/<tunnel-id>.json
ingress:
  - hostname: openclaw.yourdomain.com
    service: http://localhost:7860
  - service: http_status:404

cloudflared tunnel run openclaw

Both approaches mean your server’s port 7860 never needs to be open
to the internet at all.

Step 5: Harden the
Environment

Beyond network security, tighten the runtime:

Run as a non-root user:

# Create a dedicated user
sudo useradd -r -s /bin/false openclaw
sudo chown -R openclaw:openclaw /opt/openclaw

# Run the service as that user
sudo -u openclaw openclaw gateway start

Use environment variables
for secrets:

Never put API keys in config files. Use env vars or a secrets
manager:

export OPENAI_API_KEY="sk-..."
export ANTHROPIC_API_KEY="sk-ant-..."

Or better — use a .env file with restricted
permissions:

chmod 600 .env
chown openclaw:openclaw .env

Enable audit logging:

gateway:
  logging:
    level: info
    audit: true
    path: /var/log/openclaw/audit.log

Review these logs periodically. If someone’s poking at your instance,
you want to know.

Step 6: Keep It Updated

This is boring advice. It’s also the advice that would have prevented
CVE-2026-25253 from being exploitable for most people.

# Set up automatic update checks (add to crontab)
0 6 * * * openclaw update --check && openclaw update --yes && systemctl restart openclaw

Or if you’re using Docker Compose, look into Watchtower for automated
container updates.

Subscribe to OpenClaw’s security advisories on GitHub. When a CVE
drops, you want to know the same day — not three months later when
someone’s already in your system.

What About OpenClaw Privacy?

A secured instance is a private instance. But there are extra steps
if openclaw privacy is a concern:

Disable telemetry if the option exists in your
version’s config
Review agent memory — what’s being stored, where,
and for how long
Audit connected services — each API integration is
a potential data leak
Use local models where possible to keep data off
third-party servers

If you’re processing sensitive data through OpenClaw, consider
whether the running
costs of a beefier local setup are worth the privacy gain versus
cloud API calls. Often, they are.

The “Do This Now” Checklist

Print this out. Tape it to your monitor. Do it today.

Don’t Be Number 135,001

Most of those 135,000 exposed instances belong to people who are
perfectly capable of securing their setup. They just didn’t think about
it. The install worked, the agents ran, and they moved on.

Now you’ve thought about it. The difference between a vulnerable
instance and a hardened one is about 30 minutes of work.

Go do the checklist. Then come back and build something cool — with
the confidence that your setup isn’t someone else’s open door.

Got questions about securing your OpenClaw setup? Drop them in
the comments or check out our guide on whether OpenClaw is
safe to use for a broader look at the platform’s security
posture.