CVE-2026-32064: OpenClaw unauthenticated VNC access

CISO Take

OpenClaw's sandbox browser entrypoint starts x11vnc without any authentication, leaving the noVNC observer port exposed on the host loopback interface to any local process — no credentials required, no user interaction needed. While the local attack vector limits direct internet exposure, this is acutely dangerous in the shared-compute, containerized, and multi-tenant environments where AI agent frameworks commonly run: any co-tenant process, compromised sidecar, or local attacker can silently connect to the VNC port and observe or interact with the AI agent's browser session in real time. With EPSS placing this in the top 60th percentile of exploitation likelihood and CWE-306 (Missing Authentication for Critical Function) representing the simplest possible exploitation path — literally just connect — the effort bar is trivially low. Upgrade to OpenClaw 2026.2.21 or later (patches 621d8e1 and 8c1518f); if immediate patching is blocked, restrict loopback VNC port access via host firewall rules and audit running processes for exposed noVNC ports using netstat or ss.

Sources: NVD EPSS GitHub Advisory ATLAS vulncheck.com

What is the risk?

CVSS 7.7 High with AC:Low and PR:None makes this straightforward to exploit by any local attacker or co-tenant process. The local attack vector would normally limit exposure, but AI agent deployments overwhelmingly run in shared cloud compute, container orchestration platforms, and CI/CD pipelines where lateral movement from any compromised workload on the same host is realistic. The sandbox browser is the AI agent's eyes and hands on the web — unauthorized VNC access means an adversary can silently observe sensitive agent operations, capture credentials and session tokens displayed in the browser, or actively hijack agent interactions. With 396 CVEs in the same package, this is part of a broader pattern of security gaps in OpenClaw that warrants systemic review.

How does the attack unfold?

Local Access

Attacker obtains a foothold on the host or a co-tenant container — via compromised workload, insider access, or container escape — giving them access to the loopback interface.

AML.T0012

Port Discovery

Attacker scans the loopback interface to identify the unauthenticated noVNC port started by OpenClaw's sandbox browser entrypoint.

AML.T0006

VNC Session Hijack

Attacker connects to the noVNC port without credentials, gaining live visual access to the AI agent's active browser session and full ability to interact with it.

AML.T0049

Credential & Data Exfiltration

Attacker captures session tokens, authentication cookies, PII, or proprietary data displayed in the browser, then uses or exfiltrates them to achieve lateral movement or data theft.

AML.T0106

Local Access

Attacker obtains a foothold on the host or a co-tenant container — via compromised workload, insider access, or container escape — giving them access to the loopback interface.

AML.T0012

Port Discovery

Attacker scans the loopback interface to identify the unauthenticated noVNC port started by OpenClaw's sandbox browser entrypoint.

AML.T0006

VNC Session Hijack

Attacker connects to the noVNC port without credentials, gaining live visual access to the AI agent's active browser session and full ability to interact with it.

AML.T0049

Credential & Data Exfiltration

Attacker captures session tokens, authentication cookies, PII, or proprietary data displayed in the browser, then uses or exfiltrates them to achieve lateral movement or data theft.

AML.T0106

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

6 steps

Upgrade OpenClaw to version 2026.2.21 or later (two patches: commit 621d8e1312482f122f18c43c72c67211b141da01 and 8c1518f0f3e0533593cd2dec3a46c9b746753661).
Immediate workaround if patching is delayed: use iptables/nftables to block unauthorized access to the loopback VNC port range used by OpenClaw's noVNC sessions.
Detection: run 'ss -tlnp' or 'netstat -tlnp' on hosts running OpenClaw to enumerate exposed VNC ports; look for x11vnc processes launched without -auth or -passwd flags.
Deploy OpenClaw in dedicated network namespaces or containers with strict network isolation policies preventing lateral loopback access from other workloads.
Audit CI/CD and cloud AI agent hosts for co-tenant processes that could exploit this before the patch is deployed.
Review the full OpenClaw CVE backlog (396 CVEs) for systemic trust decisions about this package in your AI stack.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent AML.T0006 - Active Scanning AML.T0049 - Exploit Public-Facing Application AML.T0085 - Data from AI Services AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system access control and authentication

NIST AI RMF

MS-2.5 - AI risk treatment and security incident response

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32064?

OpenClaw's sandbox browser entrypoint starts x11vnc without any authentication, leaving the noVNC observer port exposed on the host loopback interface to any local process — no credentials required, no user interaction needed. While the local attack vector limits direct internet exposure, this is acutely dangerous in the shared-compute, containerized, and multi-tenant environments where AI agent frameworks commonly run: any co-tenant process, compromised sidecar, or local attacker can silently connect to the VNC port and observe or interact with the AI agent's browser session in real time. With EPSS placing this in the top 60th percentile of exploitation likelihood and CWE-306 (Missing Authentication for Critical Function) representing the simplest possible exploitation path — literally just connect — the effort bar is trivially low. Upgrade to OpenClaw 2026.2.21 or later (patches 621d8e1 and 8c1518f); if immediate patching is blocked, restrict loopback VNC port access via host firewall rules and audit running processes for exposed noVNC ports using netstat or ss.

Is CVE-2026-32064 actively exploited?

No confirmed active exploitation of CVE-2026-32064 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32064?

1. Upgrade OpenClaw to version 2026.2.21 or later (two patches: commit 621d8e1312482f122f18c43c72c67211b141da01 and 8c1518f0f3e0533593cd2dec3a46c9b746753661). 2. Immediate workaround if patching is delayed: use iptables/nftables to block unauthorized access to the loopback VNC port range used by OpenClaw's noVNC sessions. 3. Detection: run 'ss -tlnp' or 'netstat -tlnp' on hosts running OpenClaw to enumerate exposed VNC ports; look for x11vnc processes launched without -auth or -passwd flags. 4. Deploy OpenClaw in dedicated network namespaces or containers with strict network isolation policies preventing lateral loopback access from other workloads. 5. Audit CI/CD and cloud AI agent hosts for co-tenant processes that could exploit this before the patch is deployed. 6. Review the full OpenClaw CVE backlog (396 CVEs) for systemic trust decisions about this package in your AI stack.

What systems are affected by CVE-2026-32064?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks using browser-use components, Browser automation for agentic pipelines, Container-based AI agent deployments, Multi-tenant AI orchestration platforms, CI/CD pipelines with AI agent tasks.

What is the CVSS score for CVE-2026-32064?

CVE-2026-32064 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworks using browser-use componentsBrowser automation for agentic pipelinesContainer-based AI agent deploymentsMulti-tenant AI orchestration platformsCI/CD pipelines with AI agent tasks

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0049 Exploit Public-Facing Application

AML.T0085 Data from AI Services

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MS-2.5

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.

Exploitation Scenario

An attacker who has compromised a co-tenant container on a Kubernetes node running an OpenClaw-based AI agent — or who has obtained minimal local access to the host — scans the loopback interface and discovers the unauthenticated noVNC port started by OpenClaw's sandbox browser entrypoint. With a standard noVNC client or browser, the attacker connects without any credentials and gains a live view of the AI agent's browser session. The agent is authenticated to a corporate SaaS portal executing automated tasks; the attacker silently observes session cookies and CSRF tokens, copies them, and uses them to authenticate to the portal as the AI agent's service account — achieving lateral access to cloud resources with the full privileges of the AI agent's identity, all without triggering any authentication alerts.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.