PT-2026-38230

CVE-2026-43575

Published

2026-04-17

Updated

2026-05-14

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.21 through 2026.4.9

Description An authentication bypass exists in the sandbox noVNC helper route, which exposes interactive browser session credentials. This allows attackers to access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.

Recommendations Update to version 2026.4.10.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Smaeljaish771

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization