Nixpkgs security tracker

Dismissed

Permalink CVE-2026-32064

7.7 HIGH

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): NONE

updated 1 month, 1 week ago by @pyrox0 Activity log

Created suggestion 1 month, 1 week ago
@pyrox0 dismissed 1 month, 1 week ago

OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer

OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.

References

GitHub Security Advisory (GHSA-25gx-x37c-7pph) third-party-advisory
Patch Commit #1 patch
Patch Commit #2 patch
VulnCheck Advisory: OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer third-party-advisory

Affected products

OpenClaw

<2026.2.21
==2026.2.21

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

nixos-unstable 2026.3.12
- nixpkgs-unstable 2026.3.12
- nixos-unstable-small 2026.3.12

Package maintainers

@chrisportela Chris Portela <chris@chrisportela.com>

version packaged is not vulnerable

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.openclaw

Package maintainers