GitHub Advisoryadvisory · npm

GHSA-92jp-89mq-4374 OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials

MEDIUM Published 2026-04-17 Modified 2026-04-17 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-306
Reviewed
2026-04-17

Affected packages

• npm openclaw: >= 2026.2.21, < 2026.4.10 → fixed in 2026.4.10

Description

Summary Sandbox noVNC helper route exposed interactive browser session credentials. Affected Packages / Versions • Package: `openclaw` • Ecosystem: npm • Affected versions: `>= 2026.2.21 = 2026.4.10` Impact The sandbox noVNC helper route could be reached without the intended bridge authentication, exposing an interactive browser session surface. Technical Details The fix gates the sandbox noVNC helper route behind bridge authentication. Fix The issue was fixed in #63882. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix. Fix Commit(s) • `8dfbf3268bd224b7377d1ecca77a445100746085` • PR: #63882 Release Process Note Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References