MediumVulnerability
GHSA-xxvh-5hwj-42pp: OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation
- Identifiers
- CVE-2026-27007GHSA-xxvh-5hwj-42pp
- Published
- Record updated
- Affected
- openclaw < 2026.2.15
- Fixed in
- 2026.2.15
- released February 15, 2026, 2 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
The OpenClaw npm package, versions up to and including 2026.2.14, has a sandbox configuration hash that sorts arrays containing only primitive values. Because of this, order-only changes to sandbox arrays such as Docker `dns` and `binds` hash identically, so the hash can wrongly signal that existing containers are unchanged and stale containers get reused. The patch is planned for version 2026.2.15 and later.
Mitigation
Array ordering is now preserved during hash normalization; only object key ordering remains normalized for deterministic hashing. Fixed in commit 41ded303b4f6dae5afa854531ff837c3276ad60b. Upgrade to 2026.2.15 or later.