CVE-2026-28468 | THREATINT

Description

OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gateway authentication, allowing local attackers to access browser control endpoints. A local attacker can enumerate tabs, retrieve WebSocket URLs, execute JavaScript, and exfiltrate cookies and session data from authenticated browser contexts.

PUBLISHED Reserved 2026-02-27 | Published 2026-03-05 | Updated 2026-03-06 | Assigner VulnCheck

HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

HIGH: 7.7CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Problem types

Missing Authentication for Critical Function

Product status

Default status

unaffected

2026.1.29-beta.1 (custom) before 2026.2.14

affected

Credits

Adnan Jakati (@jackhax) of Praetorian reporter

References

github.com/...enclaw/security/advisories/GHSA-h9g4-589h-68xv (GitHub Security Advisory (GHSA-h9g4-589h-68xv)) vendor-advisory

github.com/...ommit/4711a943e30bc58016247152ba06472dab09d0b0 (Patch Commit #1) patch

github.com/...ommit/6dd6bce997c48752134f2d6ed89b27de01ced7e3 (Patch Commit #2) patch

github.com/...ommit/cd84885a4ac78eadb7bf321aae98db9519426d67 (Patch Commit #3) patch

www.vulncheck.com/...bypass-in-sandbox-browser-bridge-server (VulnCheck Advisory: OpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Server) third-party-advisory

cve.org (CVE-2026-28468)

nvd.nist.gov (CVE-2026-28468)

Download JSON