PT-2026-26399 · Openclaw · Openclaw

Kexinoh · Published 2026-03-03 · Updated 2026-03-20 · CVE-2026-32018

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.19

Description The software contains a race condition in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. This occurs due to unsynchronized read-modify-write operations without locking, potentially leading to data loss, resurrection of removed entries, or corruption of sandbox state. This can affect sandbox list, sandbox prune, and sandbox recreate --all operations. The registry writes were read-modify-write in a window with no locking and permissive fallback parsing, allowing concurrent registry updates to produce stale snapshots and overwrite each other, desynchronizing sandbox state.

Recommendations Update to version 2026.2.18 or later. Update to version 2026.2.19 or later. For versions prior to 2026.2.18, consider temporarily restricting concurrent access to the registry update and removal operations.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-32018

GHSA-GQ83-8Q7Q-9HFX

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gq83-8q7q-9hfx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32018 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32018 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/cc29be8c9 · Note
• https://twitter.com/CVEnew/status/2034891598492795358 · Twitter Post
• https://vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operations · Note