Which versions of OpenClaw are affected by CVE-2026-43575?

OpenClaw versions 2026.2.21 through 2026.4.9 contain a critical authentication bypass vulnerability (CVSS 9.2) that allows unauthenticated remote attackers to hijack interactive browser sessions…. A patch is available.

How to fix or mitigate CVE-2026-43575?

Within 24 hours: Inventory all OpenClaw deployments and identify instances running versions 2026.2.21 through 2026.4.9. Within 7 days: Apply vendor patch to OpenClaw version 2026.4.10 or later across all affected systems; if immediate patching is not possible, implement network-level access controls restricting access to the /sandbox/novnc endpoint to trusted IP ranges only. Within 30 days: Conduct audit of noVNC session access logs for the affected versions to detect potential unauthorized access; review and validate all authentication and authorization controls on sandbox endpoints.

OpenClaw CVE-2026-43575

Q: What is the CVSS score of CVE-2026-43575?

CVE-2026-43575 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-28163 CRITICAL

Missing Authorization (CWE-862)

2026-05-06 disclosure@vulncheck.com

Authentication Bypass Openclaw

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 21:03 EUVD

Source Code Evidence Fetched

May 06, 2026 - 20:33 vuln.today

Analysis Generated

May 06, 2026 - 20:33 vuln.today

CVE Published

May 06, 2026 - 20:16 nvd

CRITICAL 9.2

DescriptionCVE.org

OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.

AnalysisAI

Authentication bypass in OpenClaw 2026.2.21 through 2026.4.9 allows remote unauthenticated attackers to access the sandbox noVNC helper route and gain unauthorized control of interactive browser sessions. The vulnerability exposes session credentials by failing to enforce bridge authentication on the /sandbox/novnc endpoint. OpenClaw is an open-source AI agent framework. Patch available in version 2026.4.10 and later. No evidence of active exploitation (not in CISA KEV) and EPSS data not available at time of analysis.

Technical ContextAI

OpenClaw is an npm-published AI agent development framework with embedded sandbox capabilities for interactive browser automation. The vulnerability exists in the browser bridge server module which handles noVNC (browser-based VNC client) connections to sandboxed browser sessions. The root cause is CWE-862 (Missing Authorization), where the /sandbox/novnc route lacked the authentication middleware required for other bridge server endpoints. The code previously installed authentication middleware after route registration, allowing the noVNC endpoint to bypass bearer token and password verification. The GitHub commit 8dfbf3268bd224b7377d1ecca77a445100746085 shows the fix moved authentication middleware installation before route handlers and added explicit hasVerifiedBrowserAuth() checks on the noVNC route. The fix also removes browserNoVncUrl from model-visible prompt context to prevent exposure of observer URLs to AI models themselves.

RemediationAI

Upgrade to OpenClaw version 2026.4.10 or later (current release 2026.4.14 confirmed to include fix) via npm update or by installing 'openclaw@2026.4.14'. The fix is implemented in GitHub commit 8dfbf3268bd224b7377d1ecca77a445100746085 and pull request #63882. If immediate patching is not feasible, implement network-level access controls to restrict bridge server endpoints to trusted IP ranges only - specifically block external access to /sandbox/novnc routes via firewall rules or reverse proxy ACLs. Alternatively, disable the sandbox browser feature entirely if not required for operations by removing browser extension configuration (note: this prevents AI agents from using browser automation capabilities). For production environments, ensure bridge server authToken and authPassword parameters are configured with strong cryptographic values as the fix enforces these as mandatory. Review logs for unauthorized access attempts to /sandbox/novnc endpoints without Authorization headers. Vendor advisory available at https://github.com/openclaw/openclaw/security/advisories/GHSA-92jp-89mq-4374 and patch details at https://github.com/openclaw/openclaw/commit/8dfbf3268bd224b7377d1ecca77a445100746085.