CVE-2026-32064 json
OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer
published 2026-03-03 8 mo ago modified 2026-10-08 31 d ago also GHSA-25gx-x37c-7pph , EUVD-2026-13964
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.
Patch / fix
- npm openclaw 2026.2.21
- OpenClaw OpenClaw 2026.2.21
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | openclaw | <2026.2.21 |
2026.2.21 |
Affected products
- OpenClaw OpenClaw
Classification
References
-
github.com
/openclaw/openclaw/commit/621d8e1312482f122f18c43c72c67211b141da01
patch, web
-
github.com
/openclaw/openclaw/commit/8c1518f0f3e0533593cd2dec3a46c9b746753661
patch, web
-
github.com
/openclaw/openclaw/security/advisories/GHSA-25gx-x37c-7pph
vendor-advisory, web, mitigation
-
vulncheck.com
/advisories/openclaw-missing-vnc-authentication-in-sandbox-browser-novnc-observer
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-32064
advisory
-
github.com
/openclaw/openclaw
package
Sources
- CVE List CVE-2026-32064
- GitHub Advisory GHSA-25gx-x37c-7pph
- NVD CVE-2026-32064
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.