CVE-2026-32018

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32018
OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data, resurrect removed entries, or corrupt sandbox state affecting list, prune, and recreate operations.

3.6 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfx Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operations Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
History

20 Apr 2026, 14:03

Type Values Removed Values Added
First Time Openclaw openclaw
Openclaw
Summary
  • (es) Las versiones de OpenClaw anteriores a 2026.2.19 contienen una vulnerabilidad de condición de carrera en operaciones concurrentes de updateRegistry y removeRegistryEntry para contenedores y navegadores sandbox. Los atacantes pueden explotar operaciones de lectura-modificación-escritura no sincronizadas sin bloqueo para hacer que las actualizaciones del registro pierdan datos, resuciten entradas eliminadas o corrompan el estado del sandbox, afectando las operaciones de listado, poda y recreación.
CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
References () https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741 - () https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741 - Patch
References () https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfx - () https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfx - Vendor Advisory
References () https://www.vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operations - () https://www.vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operations - Third Party Advisory

19 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-19 22:16

Updated : 2026-04-20 14:03

NVD link : CVE-2026-32018

Mitre link : CVE-2026-32018

CVE.ORG link : CVE-2026-32018

JSON object : View

Products Affected

openclaw

  • openclaw
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')