CVE-2026-32018
OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption
Impact
## Impact Concurrent `updateRegistry`/`removeRegistryEntry` operations for sandbox containers and browsers could lose updates or resurrect removed entries under race conditions. The registry writes were read-modify-write in a window with no locking and permissive fallback parsing, so concurrent registry updates could produce stale snapshots and overwrite each other. That desyncs sandbox state and can affect `sandbox list`, `sandbox prune`, and `sandbox recreate --all` behavior. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.17` - Patched versions: `2026.2.18` ## Fix Commit(s) - `cc29be8c9` OpenClaw thanks @kexinoh for reporting.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openclaw | < 2026.2.19 | 2026.2.19 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openclaw | Openclaw | before 2026.2.19 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741
- https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfx
- https://www.vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operations
- https://github.com/advisories/GHSA-gq83-8q7q-9hfx
- https://github.com/openclaw/openclaw/commit/cc29be8c9
- https://nvd.nist.gov/vuln/detail/CVE-2026-32018