Описание
OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.
Ссылки
- Patch
- Patch
- MitigationVendor Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2026.2.21 (исключая)
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 43%
0.00514
Низкий
7.7 High
CVSS3
9.1 Critical
CVSS3
Дефекты
CWE-306
Связанные уязвимости
CVSS3: 7.7
github
7 месяцев назад
OpenClaw's andbox browser noVNC observer lacked VNC authentication
EPSS
Процентиль: 43%
0.00514
Низкий
7.7 High
CVSS3
9.1 Critical
CVSS3
Дефекты
CWE-306