N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-92jp-89mq-4374

GHSA-92jp-89mq-4374: OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials

Summary

Sandbox noVNC helper route exposed interactive browser session credentials.

Affected Packages / Versions

Package: openclaw
Ecosystem: npm
Affected versions: >= 2026.2.21 < 2026.4.10
Patched versions: >= 2026.4.10

Impact

The sandbox noVNC helper route could be reached without the intended bridge authentication, exposing an interactive browser session surface.

Technical Details

The fix gates the sandbox noVNC helper route behind bridge authentication.

Fix

The issue was fixed in #63882. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix.

Fix Commit(s)

8dfbf3268bd224b7377d1ecca77a445100746085
PR: #63882

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-92jp-89mq-4374

GHSA-92jp-89mq-4374:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.2.21, < 2026.4.10	2026.4.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-92jp-89mq-4374, is a missing authentication vulnerability in the openclaw package. The sandbox noVNC helper route at /sandbox/novnc was exposed without authentication, which could lead to the exposure of interactive browser session credentials. The provided commit 8dfbf3268bd224b7377d1ecca77a445100746085 patches this vulnerability. The analysis of the patch shows that the file extensions/browser/src/browser/bridge-server.ts contains the primary fix. The function startBrowserBridgeServer in this file is responsible for creating a bridge server. Inside this function, a route handler for /sandbox/novnc is registered. The patch adds an authentication check, if (!hasVerifiedBrowserAuth(req)), at the beginning of this handler. The absence of this check in the vulnerable versions is the root cause of the vulnerability. Therefore, any exploitation of this vulnerability would involve a call to this route, and a runtime profile would show activity within the startBrowserBridgeServer function, specifically within the anonymous function that handles the /sandbox/novnc route.

Vulnerable functions

startBrowserBridgeServer

extensions/browser/src/browser/bridge-server.ts

The `startBrowserBridgeServer` function in `extensions/browser/src/browser/bridge-server.ts` sets up an express server. Within this function, it defines a handler for the GET route `/sandbox/novnc`. Prior to the patch, this handler did not have an authentication check, making it publicly accessible. The vulnerability is the lack of authentication for this route, which is fixed by adding the `hasVerifiedBrowserAuth(req)` check. An exploit would involve making a request to this endpoint, and the execution would pass through the anonymous route handler defined within `startBrowserBridgeServer`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-92jp-89mq-4374: OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials

Summary

Affected Packages / Versions

Impact

Technical Details

Fix

Fix Commit(s)

Release Process Note

Credits

GHSA-92jp-89mq-4374:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-92jp-89mq-4374: OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials

Summary

Affected Packages / Versions

Impact

Technical Details

Fix

Fix Commit(s)

Release Process Note

Credits

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI