CVE-2026-32018

LOW

3.6

Beschreibung

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data, resurrect removed entries, or corrupt sandbox state affecting list, prune, and recreate operations.

CVE Details

CVSS v3.1 Bewertung3.6

SchweregradLOW

CVSS VektorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

AngriffsvektorLOCAL

KomplexitatHIGH

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht3/19/2026

Zuletzt geandert3/20/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-362

Referenzen

https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfx(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operations(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.