OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser s…

Published:

5 mei 2026 om 22:00:00

Alert date:

6 mei 2026 om 21:05:32

Source:

nvd.nist.gov

Web Technologies, Identity & Access

OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route. The vulnerability exposes interactive browser session credentials by allowing attackers to access the noVNC helper route without proper bridge authentication. This results in unauthorized access to interactive browser sessions. The issue affects the authentication mechanism in OpenClaw's sandbox environment. Multiple security advisories and patches have been released to address this vulnerability.

Technical details

Mitigation steps:

Affected products:

OpenClaw