Executive brief
OpenClaw's sandbox browser component exposes a graphical desktop session via VNC without requiring authentication, allowing anyone with network access to observe or potentially interact with browser activity. While the OpenClaw runtime typically restricts this port to localhost-only, deployments that expose the port more broadly or run the image standalone risk unauthorized access to sensitive browser sessions and screen content.
Technical details
The sandbox browser entrypoint script (scripts/sandbox-browser-entrypoint.sh) launched x11vnc with the -nopw flag, disabling VNC authentication for noVNC observer sessions. The vulnerable component exposes the VNC session via websockify for remote browser observation. While OpenClaw's default runtime (src/agents/sandbox/browser.ts) publishes the noVNC port only to localhost (127.0.0.1), reducing default exposure, operators can explicitly publish the port more broadly or run the container image standalone with broader port bindings. An attacker with network access to the noVNC port can connect and view or interact with the browser sandbox without credentials. The fix requires VNC password authentication (x11vnc -rfbauth), generates per-container noVNC passwords in the runtime, and emits short-lived observer token URLs instead of persistent passwords. This is patched in version 2026.2.21 and later.
Affected products
- OpenClaw openclaw <= 2026.2.19-2
- OpenClaw docker/openclaw <= 2026.2.19-2
Timeline
- 2026-02-21: disclosed
- 2026-03-03: advisory
- 2026-02-21: patched: Patched in version 2026.2.21
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-25gx-x37c-7pph
- https://github.com/openclaw/openclaw/commit/621d8e1312482f122f18c43c72c67211b141da01
- https://github.com/openclaw/openclaw/commit/8c1518f0f3e0533593cd2dec3a46c9b746753661
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-missing-vnc-authentication-in-sandbox-browser-novnc-observer