highCVSS 7.7Vulnerability
GHSA-cxcw-jm67-3wwp
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-25gx-x37c-7pph. This link is maintained to preserve external references. ## Original Description OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.
Properties
- ghsa_id
- GHSA-cxcw-jm67-3wwp
- severity
- high
- summary
- Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication
- cvss_score
- 7.7
- cve_id
- GHSA-cxcw-jm67-3wwp
- cvss_vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- is_ghsa_only
- true
- ghsa_published
- 2026-03-21T03:31:14Z
- source_url
- https://github.com/advisories/GHSA-cxcw-jm67-3wwp
- ghsa_updated
- 2026-03-24T19:06:53Z
Related Entities (3)
AFFECTS (1)
→[Software]npm/OpenClaw
HAS_WEAKNESS (1)
→[Weakness]Missing Authentication for Critical Function
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph