CVE-2026-32064highCWE-306

OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.5epss 0.5%

probabilidad de explotación

0.5%top 59% de las CVE

explotación observada

noninguna fuente lo reporta

OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Productos afectados

OpenClaw · OpenClaw

Referencias

https://github.com/openclaw/openclaw/commit/621d8e1312482f122f18c43c72c67211b141da01 https://github.com/openclaw/openclaw/commit/8c1518f0f3e0533593cd2dec3a46c9b746753661 https://github.com/openclaw/openclaw/security/advisories/GHSA-25gx-x37c-7pph https://www.vulncheck.com/advisories/openclaw-missing-vnc-authentication-in-sandbox-browser-novnc-observer