PT-2026-26741 · Novnc+2 · Novnc+2

Rafael M · Published 2026-03-03 · Updated 2026-03-22 · CVE-2026-32064

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.21

Description The OpenClaw sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, granting unauthenticated access to the VNC interface. Attackers on the host loopback interface can connect to the exposed noVNC port and observe or interact with the sandbox browser without credentials. The issue affects versions prior to 2026.2.21.

Recommendations Update OpenClaw to version 2026.2.21 or later.

Fix

Missing Authentication

Missing Authorization

Improper Authentication

Weakness Enumeration

CWE-306

CWE-862

CWE-287

Related Identifiers

CVE-2026-32064

GHSA-25GX-X37C-7PPH

GHSA-CXCW-JM67-3WWP

Affected Products

Openclaw

Novnc

X11Vnc

References · 13

• https://github.com/openclaw/openclaw/security/advisories/GHSA-25gx-x37c-7pph · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/8c1518f0f3e0533593cd2dec3a46c9b746753661 · Patch
• https://github.com/openclaw/openclaw/commit/621d8e1312482f122f18c43c72c67211b141da01 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32064 · Security Note
• https://osv.dev/vulnerability/GHSA-cxcw-jm67-3wwp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-25gx-x37c-7pph · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32064 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-missing-vnc-authentication-in-sandbox-browser-novnc-observer · Note
• https://twitter.com/AgenticYield/status/2035715778230563162 · Twitter Post
• https://twitter.com/RedPacketSec/status/2035383646308147544 · Twitter Post
• https://twitter.com/CVEnew/status/2035237328973963634 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035239073812500861 · Twitter Post