OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption
## Impact Concurrent `updateRegistry`/`removeRegistryEntry` operations for sandbox containers and browsers could lose updates or resurrect removed entries under race conditions. The registry writes were read-modify-write in a window with no locking and permissive fallback parsing, so concurrent registry updates could produce stale snapshots and overwrite each other. That desyncs sandbox state and can affect `sandbox list`, `sandbox prune`, and `sandbox recreate --all` behavior. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.17` - Patched versions: `2026.2.18` ## Fix Commit(s) - `cc29be8c9` OpenClaw thanks @kexinoh for reporting.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-32018US | medium4.8 | — | ||
OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Att… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/cc29be8c9WEB
- https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfxWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-32018ADVISORY
- https://www.vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operationsWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan