CVE-2026-32018: Openclaw

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data, resurrect removed entries, or corrupt sandbox state affecting list, prune, and recreate operations.

Affected products

• Openclaw Openclaw: before 2026.2.19 (fixed in 2026.2.19)

Published 2026-03-19. Last modified 2026-06-17.