What is the CVSS score of CVE-2026-32064?

CVE-2026-32064 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-32064?

OpenClaw sandbox browser sessions can be viewed and controlled by unauthorized users on the same network without authentication, creating a direct risk to sensitive data processed within sandboxed…. A patch is available.

Is there a public PoC exploit available for CVE-2026-32064?

Yes, a public proof-of-concept exploit is available for CVE-2026-32064. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-32064?

Within 24 hours: Inventory all OpenClaw installations and identify which versions are in use; assess whether any sandboxed browser sessions process sensitive or confidential data. Within 7 days: Apply vendor patch 2026.2.21 or later to all affected systems, prioritizing production environments; validate patches in a test environment before production deployment. Within 30 days: Conduct post-patch verification across all systems and review access logs for any unauthorized x11vnc connections during the vulnerability window.

Openclaw CVE-2026-32064

EUVD-2026-13964 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-21 VulnCheck

GHSA-cxcw-jm67-3wwp

GHSA-25gx-x37c-7pph

Authentication Bypass Openclaw

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Mar 24, 2026 - 21:10 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 01:00 euvd

EUVD-2026-13964

Analysis Generated

Mar 21, 2026 - 01:00 vuln.today

Patch released

Mar 21, 2026 - 01:00 nvd

Patch available

CVE Published

Mar 21, 2026 - 00:42 nvd

HIGH 7.7

DescriptionCVE.org

OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.

AnalysisAI

OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, allowing any attacker with access to the host's loopback interface to view or interact with sandboxed browser sessions without credentials. All OpenClaw versions prior to 2026.2.21 are affected. This vulnerability has been publicly disclosed with patches available from the vendor, though no EPSS score, KEV status, or public POC references were provided in the intelligence data.

Technical ContextAI

The vulnerability affects OpenClaw (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), specifically the sandbox browser entrypoint component that utilizes x11vnc to expose VNC sessions through noVNC for browser-based observer functionality. The root cause is CWE-306 (Missing Authentication for Critical Function), where the x11vnc server is configured to accept connections without any authentication mechanism. The noVNC interface, typically used to provide web-based VNC access, becomes accessible to any process or user capable of connecting to the loopback interface where the VNC port is exposed. This represents a fundamental authentication bypass in a critical security boundary intended to isolate sandbox browser sessions.

RemediationAI

Upgrade OpenClaw to version 2026.2.21 or later, which includes patches that address the missing VNC authentication issue. The vendor has published specific fix commits at https://github.com/openclaw/openclaw/commit/621d8e1312482f122f18c43c72c67211b141da01 and https://github.com/openclaw/openclaw/commit/8c1518f0f3e0533593cd2dec3a46c9b746753661 that can be reviewed for implementation details. Until patching is completed, organizations should implement network-level controls to restrict access to the VNC/noVNC ports on the loopback interface, use firewall rules to limit connections only from authorized processes, or disable the sandbox browser observer functionality entirely if not operationally required. Consult the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-25gx-x37c-7pph for additional vendor guidance.