CVE-2026-43575 is an authentication bypass that allows an attacker to reach the sandbox noVNC helper route without satisfying the required bridge authentication. Once accessed, the route exposes credentials for the interactive browser session, giving the attacker full control over that session. The flaw is classified as CWE-862, reflecting an authorization bypass where privileged access is granted to an unauthenticated user. The impact is a loss of confidentiality and integrity of user sessions and the potential for further lateral movement within the environment.

All OpenClaw releases prior to 2026.4.10, including the 2026.2.21 build, are affected. The OpenClaw product contains the sandbox noVNC helper route that is vulnerable when these older versions are deployed.

The CVSS score of 9.2 indicates critical severity. EPSS is unavailable, and the vulnerability is not listed in CISA KEV, so the actual exploitation probability is unknown. The attack vector is via unauthenticated HTTP requests to the noVNC helper endpoint, which can be performed by any entity with network access to the route, either remotely or from an internal host.