Vulnerability · Published Mar 19, 2026 · Assigned by VulnCheck

CVE-2026-32018OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations

Low 3.6

In plain English

A low-severity race condition in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.6Low

Exploit odds (30 days)0.1%top 96.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data, resurrect removed entries, or corrupt sandbox state affecting list, prune, and recreate operations.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	openclaw	2026.2.19	GHSA-gq83-8q7q-9hfx

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw	0 – before 2026.2.19

Weakness: CWE-362 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

References

GitHub Security Advisory (GHSA-gq83-8q7q-9hfx) vendor-advisory
Patch Commit patch
VulnCheck Advisory: OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations third-party-advisory