Critical Security Flaw in OpenClaw AI: Unauthenticated Sandbox Access via Middleware Misconfiguration

GHSA-92JP-89MQ-4374: Unauthenticated Sandbox Access and Context Leakage in OpenClaw

The OpenClaw AI assistant platform was found to contain a critical vulnerability, tracked as GHSA-92JP-89MQ-4374, which permits unauthenticated sandbox access. This flaw carries a CVSS score of 9.8 due to the bypass of authorization controls via incorrect middleware ordering.

Why This Matters

This vulnerability highlights the gap between intended AI isolation and the reality of web infrastructure security. While sandboxes are designed to contain AI actions, improper Express.js middleware configuration can expose these internal environments to the public internet, leading to full interactive session hijacking. The failure to secure the Browser Bridge Server demonstrates that even sophisticated AI platforms are susceptible to classic web vulnerabilities like CWE-287.

Key Insights

• CVSS 9.8 Critical Severity vulnerability identified in OpenClaw (GHSA, 2026)
• Improper middleware ordering in Express.js allowed authorization bypass (CWE-287)
• LLM system prompt data leakage exposed sensitive sandbox URLs to unauthenticated users (CWE-200)
• The vulnerability affects the OpenClaw Browser Bridge Server and Sandbox Environment components
• Remediation requires updating the openclaw dependency to version 2026.4.9 and restarting gateway services

Practical Applications

• Use case: OpenClaw platform operators must update to version 2026.4.9 to ensure sandbox sessions are protected by mandatory authentication.
• Pitfall: Relying on middleware for security without verifying route-level enforcement can lead to unauthorized access if ordering is incorrect.
• Use case: Security auditors should verify that LLM system prompts do not leak internal URLs or session tokens during normal operation.
• Pitfall: Exposing noVNC ports to the open internet without IP whitelisting creates an unnecessary attack surface for interactive session hijacking.

References:

• https://dev.to/cverports/ghsa-92jp-89mq-4374-ghsa-92jp-89mq-4374-unauthenticated-sandbox-access-and-context-leakage-in-56k5