OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption
## Impact Concurrent `updateRegistry`/`removeRegistryEntry` operations for sandbox containers and browsers could lose updates or resurrect removed entries under race conditions. The registry writes were read-modify-write in a window with no locking and permissive fallback parsing, so concurrent registry updates could produce stale snapshots and overwrite each other. That desyncs sandbox state and can affect `sandbox list`, `sandbox prune`, and `sandbox recreate --all` behavior. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.17` - Patched versions: `2026.2.18` ## Fix Commit(s) - `cc29be8c9` OpenClaw thanks @kexinoh for reporting.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32018US | medium4.8 | — | ||
OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Att… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/cc29be8c9WEB
- https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfxWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-32018ADVISORY
- https://www.vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operationsWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan