CVE-2026-32018

Katalog CVE

CVSS 4.8 · Medium EPSS 0,21%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada openclaw. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data, resurrect removed entries, or corrupt sandbox state affecting list, prune, and recreate operations.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfx advisory vendor
• https://github.com/openclaw/openclaw/commit/cc29be8c9bcdfaecb90f0ab13124c8f5362a6741 patch
• https://www.vulncheck.com/advisories/openclaw-race-condition-in-sandbox-registry-write-operations advisory pihak ketiga