CVE-2026-32064

Katalog CVE

CVSS 9.1 · Critical EPSS 0,51%

Kerentanan Missing Authentication for Critical Function pada openclaw. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.

Rincian

Terbit di NVD

21 Maret 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-25gx-x37c-7pph mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/621d8e1312482f122f18c43c72c67211b141da01 patch
• https://github.com/openclaw/openclaw/commit/8c1518f0f3e0533593cd2dec3a46c9b746753661 patch
• https://www.vulncheck.com/advisories/openclaw-missing-vnc-authentication-in-sandbox-browser-novnc-observer advisory pihak ketiga