CVE-2026-43575CWE-862

OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route

Critical · published May 6, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00773 · 55.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-06T19:49Z
EPSS history
Timeline
  • 06 MAY 19:49Z
    OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route
    cvelistv5