CVE-2026-43575: OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route
OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43575?
CVE-2026-43575 has been classified as a high severity vulnerability due to its potential to allow unauthorized access to sensitive browser session credentials.
How do I fix CVE-2026-43575?
To fix CVE-2026-43575, upgrade OpenClaw to version 2026.4.10 or later.
What types of systems are affected by CVE-2026-43575?
CVE-2026-43575 affects OpenClaw versions from 2026.2.21 up to but not including 2026.4.10.
What kind of vulnerability is CVE-2026-43575?
CVE-2026-43575 is an authentication bypass vulnerability that can expose interactive browser session credentials.
Can CVE-2026-43575 be exploited remotely?
Yes, CVE-2026-43575 can be exploited remotely, allowing attackers to intercept and access user credentials.