7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-h9g4-589h-68xv

GHSA-h9g4-589h-68xv: OpenClaw has an authentication bypass in sandbox browser bridge server

Summary

openclaw could start the sandbox browser bridge server without authentication.

When the sandboxed browser is enabled, openclaw runs a local (loopback) HTTP bridge that exposes browser control endpoints (for example /profiles, /tabs, /tabs/open, /agent/*). Due to missing auth wiring in the sandbox initialization path, that bridge server accepted requests without requiring gateway auth.

Impact

A local attacker (any process on the same machine) could access the bridge server port and:

enumerate open tabs and retrieve CDP WebSocket URLs
open/close/navigate tabs
execute JavaScript in page contexts via CDP
exfiltrate cookies/session data and page contents from authenticated sessions

This is a localhost-only exposure (CVSS AV:L), but provides full browser-session compromise for sandboxed browser usage.

Affected Versions

Introduced in: 2026.1.29-beta.1 (first npm release that shipped the sandbox browser bridge)
Affected range: >=2026.1.29-beta.1 <2026.2.14

Patched Versions

2026.2.14

Mitigation

Upgrade to 2026.2.14 (recommended).
Or disable the sandboxed browser (agents.defaults.sandbox.browser.enabled=false).

Fix Details

The sandbox browser bridge server now always requires auth and enforces the same gateway browser control auth (token/password) that loopback browser clients already use.
Additional hardening: bridge server refuses non-loopback binds; local helper servers are bound to loopback.
Added regression tests (including unit coverage for per-port bridge auth fallback).

Fix commits:

openclaw/openclaw@4711a943e30bc58016247152ba06472dab09d0b0
openclaw/openclaw@6dd6bce997c48752134f2d6ed89b27de01ced7e3
openclaw/openclaw@cd84885a4ac78eadb7bf321aae98db9519426d67

Credits

Thanks to Adnan Jakati (@jackhax) of Praetorian for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-h9g4-589h-68xv

GHSA-h9g4-589h-68xv:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.1.29-beta.1, < 2026.2.14	2026.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass in the OpenClaw sandbox browser bridge server. The root cause is that the startBrowserBridgeServer function in src/browser/bridge-server.ts would instantiate an HTTP server without any authentication middleware if it was not explicitly provided with an authToken.

The execution flow that triggers this vulnerability starts in src/agents/sandbox/context.ts with the resolveSandboxContext function. In vulnerable versions, this function called ensureSandboxBrowser (from src/agents/sandbox/browser.ts) without any authentication parameters. Consequently, ensureSandboxBrowser would proceed to call startBrowserBridgeServer without the necessary auth tokens. This resulted in an unauthenticated server running on a local port, exposing sensitive browser control endpoints.

The patch addresses this at multiple levels. First, it modifies resolveSandboxContext to always resolve authentication credentials. Second, it updates ensureSandboxBrowser to accept and pass down these credentials. Finally, and most critically, it hardens startBrowserBridgeServer in two ways: it adds a check to ensure that either a token or password is provided, and it adds a new middleware function, isAuthorizedBrowserRequest, to validate incoming requests against those credentials. A subsequent commit further hardens this by ensuring the server only binds to loopback interfaces and by generating a random token if no other authentication is configured, guaranteeing the server is never unauthenticated.

Vulnerable functions

startBrowserBridgeServer

src/browser/bridge-server.ts

This function is responsible for starting the browser bridge HTTP server. The vulnerability lies in its failure to enforce authentication. If the function was called without an `authToken` parameter, it would proceed to set up the server and expose all its routes without any authentication middleware. This allowed any local process to send commands to the browser control endpoints.

ensureSandboxBrowser

src/agents/sandbox/browser.ts

This function orchestrates the setup of the sandboxed browser. In the vulnerable versions, it would call `startBrowserBridgeServer` (indirectly via an `ensureBridge` helper) without providing any authentication parameters. The patch adds the `bridgeAuth` parameter to ensure that authentication details are passed down to the server creation logic.

resolveSandboxContext

src/agents/sandbox/context.ts

This is the high-level function that initializes the sandbox environment. The vulnerability originates here, as this function was responsible for, but failed to, initiate the authentication flow for the sandbox browser bridge. The patch corrects this by adding logic to resolve browser control authentication and pass it down the call chain to `ensureSandboxBrowser`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.1

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-h9g4-589h-68xv: OpenClaw has an authentication bypass in sandbox browser bridge server

Summary

Impact

Affected Versions

Patched Versions

Mitigation

Fix Details

Credits

GHSA-h9g4-589h-68xv:

7.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

GHSA-h9g4-589h-68xv: OpenClaw has an authentication bypass in sandbox browser bridge server

Summary

Impact

Affected Versions

Patched Versions

Mitigation

Fix Details

Credits

7.1

7.1

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI