CVE-2026-43575

Katalog CVE

CVSS 9.8 · Critical EPSS 0,77%

Kerentanan Missing Authorization pada openclaw. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-92jp-89mq-4374 mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/8dfbf3268bd224b7377d1ecca77a445100746085 patch
• https://www.vulncheck.com/advisories/openclaw-authentication-bypass-in-sandbox-novnc-helper-route advisory pihak ketiga