Horizon Alert
Summary of the vulnerability and why it matters
An authentication bypass vulnerability exists in OpenClaw's noVNC helper route. This issue allows unauthorized access to interactive browser sessions by bypassing necessary bridge authentication. Teams should pay attention because this could expose sensitive session data and enable unauthorized control of user sessions.
- Bypasses authentication.
- Exposes interactive sessions.
- Can be reached from the internet.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this flaw by directly accessing the sandbox noVNC helper route without needing authentication. This allows them to gain unauthorized access to interactive browser sessions.
- No authentication required.
- Targets noVNC helper route.
- Exposes browser session credentials.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows attackers to bypass authentication to a noVNC helper route, potentially exposing interactive browser session credentials. Given its critical severity and direct authentication bypass capabilities, it presents a tempting target for threat actors seeking unauthorized access to user sessions. While there is no immediate indication of widespread exploitation, the nature of the vulnerability suggests it could be actively sought by those looking to gain control over systems with exposed interactive sessions.
- No known exploitation in the wild.
- Public exploit code is unavailable.
- Published only recently.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of OpenClaw versions between 2026.2.21 and 2026.4.10 due to a critical authentication bypass in the noVNC helper route, which can expose session credentials and grant unauthorized access. If patching is delayed, isolate affected services to prevent exploitation of this vulnerability.
- Patch OpenClaw to 2026.4.10 or later.
- Isolate vulnerable services from the network.
- Monitor for unauthorized access attempts.
