Openclaw cli: OpenClaw's andbox browser noVNC observer lacked VNC authentication (CVE-2026-32064)

The OpenClaw CLI sandbox browser entrypoint script launched x11vnc with the '-nopw' option, disabling password authentication for noVNC observer sessions. Although the noVNC port was bound to the host loopback interface (127.0.0.1), preventing remote exposure by default, operators who exposed the port more broadly or ran the container with broad port publishing could allow unauthenticated access. The fix replaced '-nopw' with '-rfbauth' to require VNC password authentication, introduced per-container noVNC passwords injected via environment variables, and switched to short-lived observer token URLs instead of sharing raw passwords. The patch is included starting from openclaw-cli version 2026.2.21.

An attacker with local access to the host or network access to an exposed noVNC port could connect to the noVNC observer session without authentication, potentially gaining unauthorized access to the sandbox browser's graphical interface. This could lead to disclosure of sensitive information or unauthorized interaction with the sandbox environment. The default configuration limits exposure to local access only, reducing risk unless the port is explicitly exposed externally.

Upgrade openclaw-cli to version 2026.2.21 or later where the vulnerability is fixed. The fix enforces VNC password authentication and uses short-lived observer tokens. Rebuild the sandbox browser image and recreate browser containers to apply the fix. Avoid publishing the noVNC port on non-loopback interfaces to prevent external exposure. Follow the vendor's advisory and patch instructions to ensure proper remediation.