CVE-2026-32064 json
OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer
published 8mo ago modified last mo. also GHSA-25gx-x37c-7pph , EUVD-2026-13964
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.
Patch / fix
- npm openclaw 2026.2.21
- OpenClaw OpenClaw 2026.2.21
Is CVE-2026-32064 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7mo ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | openclaw | <2026.2.21 |
2026.2.21 |
Affected products
- OpenClaw OpenClaw
Classification
References
-
github.com
/openclaw/openclaw/commit/621d8e1312482f122f18c43c72c67211b141da01
patch, web
-
github.com
/openclaw/openclaw/commit/8c1518f0f3e0533593cd2dec3a46c9b746753661
patch, web
-
github.com
/openclaw/openclaw/security/advisories/GHSA-25gx-x37c-7pph
vendor-advisory, web, mitigation
-
vulncheck.com
/advisories/openclaw-missing-vnc-authentication-in-sandbox-browser-novnc-observer
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-32064
advisory
-
github.com
/openclaw/openclaw
package
Sources
- CVE List CVE-2026-32064
- GitHub Advisory GHSA-25gx-x37c-7pph
- NVD CVE-2026-32064
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.