Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 🔧 **Patch**: Version **2026.4.10** or later. 🔗 **Ref**: GitHub Security Advisory GHSA-92jp-89mq-4374. Commit 8dfbf32 fixes it.

Q: What if no patch? (Workaround)

🛑 **Workaround**: Isolate the sandbox network. 🚫 **Block**: Restrict access to noVNC helper routes via firewall/WAF. 👀 **Monitor**: Alert on unauthorized access attempts to these endpoints.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: **CRITICAL**. 📈 **CVSS**: 9.1 (High). ⚡ **Action**: Patch immediately. Low barrier to entry + high impact (full session compromise) = urgent remediation needed.

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: OpenClaw's sandbox noVNC helper route lacks proper auth checks.
💥 **Consequences**: Attackers bypass bridge auth to access interactive browser sessions. Credentials are exposed.…

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **CWE-862**: Missing Authorization.
🔍 **Flaw**: The noVNC helper route does not verify user identity before granting access. It trusts the request blindly.

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Vendor**: OpenClaw.
📉 **Affected**: Versions **before 2026.4.10**.
⚠️ **Includes**: Version 2026.2.21 and all prior releases.

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

👤 **Privileges**: Unauthorized access to sandboxed browser sessions.
📂 **Data**: Full visibility of interactive browser UI. Potential credential theft from exposed sessions.

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

📉 **Threshold**: **LOW**.
🔑 **Auth**: None required.
🌐 **Config**: Network accessible (AV:N). No user interaction needed (UI:N). Easy remote exploitation.

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🚫 **Public Exp**: No PoC listed in data.
🌍 **Wild Exp**: Unconfirmed.
📝 **Note**: VulnCheck advisory exists, but code-level exploit is not public yet.

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Check**: Scan for OpenClaw instances.
🧪 **Test**: Attempt direct access to noVNC helper routes without authentication tokens.
📊 **Indicator**: Look for version strings < 2026.4.10.

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Fixed**: Yes.
🔧 **Patch**: Version **2026.4.10** or later.
🔗 **Ref**: GitHub Security Advisory GHSA-92jp-89mq-4374. Commit 8dfbf32 fixes it.

Question 9

What if no patch? (Workaround)

Accepted Answer

🛑 **Workaround**: Isolate the sandbox network.
🚫 **Block**: Restrict access to noVNC helper routes via firewall/WAF.
👀 **Monitor**: Alert on unauthorized access attempts to these endpoints.

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔥 **Priority**: **CRITICAL**.
📈 **CVSS**: 9.1 (High).
⚡ **Action**: Patch immediately. Low barrier to entry + high impact (full session compromise) = urgent remediation needed.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-43575 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring