{"id":"GHSA-h9g4-589h-68xv","summary":"OpenClaw has an authentication bypass in sandbox browser bridge server","details":"## Summary\n\nopenclaw could start the sandbox browser bridge server without authentication.\n\nWhen the sandboxed browser is enabled, openclaw runs a local (loopback) HTTP bridge that exposes browser control endpoints (for example `/profiles`, `/tabs`, `/tabs/open`, `/agent/*`). Due to missing auth wiring in the sandbox initialization path, that bridge server accepted requests without requiring gateway auth.\n\n## Impact\n\nA local attacker (any process on the same machine) could access the bridge server port and:\n\n- enumerate open tabs and retrieve CDP WebSocket URLs\n- open/close/navigate tabs\n- execute JavaScript in page contexts via CDP\n- exfiltrate cookies/session data and page contents from authenticated sessions\n\nThis is a localhost-only exposure (CVSS AV:L), but provides full browser-session compromise for sandboxed browser usage.\n\n## Affected Versions\n\n- Introduced in: `2026.1.29-beta.1` (first npm release that shipped the sandbox browser bridge)\n- Affected range: `\u003e=2026.1.29-beta.1 \u003c2026.2.14`\n\n## Patched Versions\n\n- `2026.2.14`\n\n## Mitigation\n\n- Upgrade to `2026.2.14` (recommended).\n- Or disable the sandboxed browser (`agents.defaults.sandbox.browser.enabled=false`).\n\n## Fix Details\n\n- The sandbox browser bridge server now always requires auth and enforces the same gateway browser control auth (token/password) that loopback browser clients already use.\n- Additional hardening: bridge server refuses non-loopback binds; local helper servers are bound to loopback.\n- Added regression tests (including unit coverage for per-port bridge auth fallback).\n\nFix commits:\n\n- openclaw/openclaw@4711a943e30bc58016247152ba06472dab09d0b0\n- openclaw/openclaw@6dd6bce997c48752134f2d6ed89b27de01ced7e3\n- openclaw/openclaw@cd84885a4ac78eadb7bf321aae98db9519426d67\n## Credits\n\nThanks to Adnan Jakati (@jackhax) of [Praetorian](https://www.praetorian.com/) for reporting this issue.","aliases":["CVE-2026-28468"],"modified":"2026-03-05T22:11:20.880121Z","published":"2026-02-18T17:45:31Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-306"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-02-18T17:45:31Z"},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h9g4-589h-68xv"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/4711a943e30bc58016247152ba06472dab09d0b0"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/6dd6bce997c48752134f2d6ed89b27de01ced7e3"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/cd84885a4ac78eadb7bf321aae98db9519426d67"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"}],"affected":[{"package":{"name":"openclaw","ecosystem":"npm","purl":"pkg:npm/openclaw"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2026.1.29-beta.1"},{"fixed":"2026.2.14"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-h9g4-589h-68xv/GHSA-h9g4-589h-68xv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}