PT-2026-26741

CVE-2026-32064

Publicado

2026-03-03

Atualizado

2026-10-08

Descrição por

CVSS 3.1

9.1

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.21

Description The OpenClaw sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, granting unauthenticated access to the VNC interface. Attackers on the host loopback interface can connect to the exposed noVNC port and observe or interact with the sandbox browser without credentials. The issue affects versions prior to 2026.2.21.

Recommendations Update OpenClaw to version 2026.2.21 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Rafael M

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-287: Improper Authentication

CWE-862: Missing Authorization