OpenClaw CVE-2026-32064

Exploitation requires the OpenClaw Docker sandbox-browser feature to be in use (the noVNC observer flow spawned by scripts/sandbox-browser-entrypoint.sh running x11vnc with -nopw), and the attacker must be able to reach the noVNC port. By default that port is bound to host loopback (127.0.0.1) only, so the attacker needs local presence on the host - a co-resident process, another container, or shell access - OR the operator must have explicitly re-published the port to a broader interface (or run the image standalone with wide port publishing), which removes the loopback limit. No credentials, user interaction, or privileges are needed once the port is reachable. The loopback-default binding is the primary limiting factor keeping this from being remotely exploitable across the network.

Signals are consistent and point to a real-but-bounded risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, low-complexity exploitation, but the AV:L designation is the critical limiter: the vendor advisory confirms the noVNC port is published only to host loopback (127.0.0.1) by default, so an attacker must already have code execution or a presence on the host (or an operator must have deliberately re-exposed the port to a broader interface). This explains why EPSS is very low (0.04%, 11th percentile) and SSVC rates Exploitation as 'none' and Automatable as 'no' despite a 'total' technical impact - it is not a mass-exploitable internet-facing flaw. It is NOT in CISA KEV, so there is no evidence of active exploitation, though public POC code exists (distinct signals - POC availability is not active exploitation). The 8.5/total-impact rating reflects the full observe-and-interact control an attacker gains over the sandbox browser once local access is obtained, not broad reachability. Net: a legitimate patch-priority item for OpenClaw operators, especially multi-tenant hosts or any deployment that widened the port exposure, but not a drop-everything internet-exposed emergency.

An attacker who has gained a local foothold on an OpenClaw host (e.g., another low-privileged container/process, or a co-tenant on a shared host) connects to the loopback-bound noVNC port, which runs x11vnc with -nopw and therefore requires no credentials. They observe and interact with the sandbox browser session - reading authenticated pages, hijacking the agent's browsing, or driving the browser to attacker-chosen actions. Public exploit code exists, and the attack is trivial where an operator has re-published the noVNC port beyond loopback.