CVE-2026-32018: OpenClaw race condition corrupts

CISO Take

OpenClaw versions before 2026.2.19 contain a race condition (CWE-362) in concurrent sandbox registry operations, allowing a low-privileged local attacker to corrupt registry state — causing removed sandbox container or browser entries to be resurrected, or valid entries to lose data. Although the CVSS score is low (3.6), the 97th-percentile EPSS signals higher-than-typical exploitation likelihood for this class of flaw, and with AIID #1368 documenting real malicious skills circulating through OpenClaw's ClawHub ecosystem delivering credential stealers, registry integrity is operationally critical — a resurrected evicted entry could bypass your defenses and reactivate a blocked malicious skill. No public exploit exists and exploitation requires local timing precision, but any deployment where sandbox enforcement is the primary control boundary against malicious skills should treat this as urgent. Upgrade to OpenClaw ≥2026.2.19 (patch commit cc29be8) immediately; in the interim, serialize concurrent registry operations via application-level locking and audit registry state after any add/remove cycle.

Sources: NVD EPSS GitHub Advisory ATLAS AIID

What is the risk?

Moderate effective risk despite the low CVSS (3.6). The local attack vector and high complexity limit opportunistic exploitation, but the 97th-percentile EPSS and the live malicious-skills threat landscape documented in AIID #1368 elevate real-world exposure for OpenClaw operators. The key risk amplifier is architectural: sandbox enforcement is OpenClaw's primary isolation boundary, and corrupting registry state directly undermines that control. Multi-user or multi-agent deployments with concurrent workloads face the highest exposure surface.

How does the attack unfold?

Initial Access

Attacker obtains or abuses a low-privilege account on the host running OpenClaw, sufficient to interact with concurrent registry operations.

AML.T0012

Race Condition Trigger

Attacker initiates precisely-timed concurrent updateRegistry and removeRegistryEntry calls targeting the same sandbox or browser entry, exploiting the absence of locking to win the read-modify-write race.

AML.T0107

Registry State Corruption

The unsynchronized operation causes the removal to be overwritten, resurrecting a previously-evicted entry (e.g., a blocked malicious skill container) back to active status in the registry.

AML.T0097

Sandbox Control Bypass

The resurrected entry regains active status and agent-granted sandbox permissions, allowing the associated malicious skill or container to execute as if the removal never occurred.

AML.T0081

Initial Access

Attacker obtains or abuses a low-privilege account on the host running OpenClaw, sufficient to interact with concurrent registry operations.

AML.T0012

Race Condition Trigger

Attacker initiates precisely-timed concurrent updateRegistry and removeRegistryEntry calls targeting the same sandbox or browser entry, exploiting the absence of locking to win the read-modify-write race.

AML.T0107

Registry State Corruption

The unsynchronized operation causes the removal to be overwritten, resurrecting a previously-evicted entry (e.g., a blocked malicious skill container) back to active status in the registry.

AML.T0097

Sandbox Control Bypass

The resurrected entry regains active status and agent-granted sandbox permissions, allowing the associated malicious skill or container to execute as if the removal never occurred.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

3.6 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C None

I Low

A Low

What should I do?

5 steps

Patch: Upgrade to OpenClaw ≥2026.2.19 immediately (upstream patch: cc29be8c).
Workaround: If patching is delayed, enforce application-level serialization of concurrent updateRegistry and removeRegistryEntry calls targeting the same entry.
Detection: After any sandbox removal operation, re-query the registry and alert if the removed entry reappears.
Audit: Review registry state on all OpenClaw hosts for unexpected entries — cross-reference against known-good allowlists, especially given AIID #1368's malicious-skills precedent.
Restrict: Limit concurrent agent workloads on shared OpenClaw instances until patched.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent Framework AML.T0081 - Modify AI Agent Configuration AML.T0097 - Virtualization/Sandbox Evasion AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system operation and monitoring

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to respond to AI system anomalies, incidents, and errors

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32018?

OpenClaw versions before 2026.2.19 contain a race condition (CWE-362) in concurrent sandbox registry operations, allowing a low-privileged local attacker to corrupt registry state — causing removed sandbox container or browser entries to be resurrected, or valid entries to lose data. Although the CVSS score is low (3.6), the 97th-percentile EPSS signals higher-than-typical exploitation likelihood for this class of flaw, and with AIID #1368 documenting real malicious skills circulating through OpenClaw's ClawHub ecosystem delivering credential stealers, registry integrity is operationally critical — a resurrected evicted entry could bypass your defenses and reactivate a blocked malicious skill. No public exploit exists and exploitation requires local timing precision, but any deployment where sandbox enforcement is the primary control boundary against malicious skills should treat this as urgent. Upgrade to OpenClaw ≥2026.2.19 (patch commit cc29be8) immediately; in the interim, serialize concurrent registry operations via application-level locking and audit registry state after any add/remove cycle.

Is CVE-2026-32018 actively exploited?

No confirmed active exploitation of CVE-2026-32018 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32018?

1. Patch: Upgrade to OpenClaw ≥2026.2.19 immediately (upstream patch: cc29be8c). 2. Workaround: If patching is delayed, enforce application-level serialization of concurrent updateRegistry and removeRegistryEntry calls targeting the same entry. 3. Detection: After any sandbox removal operation, re-query the registry and alert if the removed entry reappears. 4. Audit: Review registry state on all OpenClaw hosts for unexpected entries — cross-reference against known-good allowlists, especially given AIID #1368's malicious-skills precedent. 5. Restrict: Limit concurrent agent workloads on shared OpenClaw instances until patched.

What systems are affected by CVE-2026-32018?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandbox environments, browser automation pipelines.

What is the CVSS score for CVE-2026-32018?

CVE-2026-32018 has a CVSS v3.1 base score of 3.6 (LOW). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworkssandbox environmentsbrowser automation pipelines

MITRE ATLAS Techniques

AML.T0081 Modify AI Agent Configuration

AML.T0097 Virtualization/Sandbox Evasion

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data, resurrect removed entries, or corrupt sandbox state affecting list, prune, and recreate operations.

Exploitation Scenario

An attacker with low-privilege local access to an OpenClaw host — or a malicious skill that has achieved code execution within the agent environment — triggers concurrent updateRegistry and removeRegistryEntry calls against the same sandbox entry. The target entry is a previously-blocked malicious skill container that a security scan flagged and removed. Due to unsynchronized read-modify-write, the remove operation loses the race against the update; the blocked container is resurrected in the registry and regains active status. The malicious skill re-emerges as a live sandbox entry, survives the removal, and resumes execution with full agent-granted permissions inside the sandbox environment — directly mirroring the credential-exfiltration scenario documented in AIID #1368.

Weaknesses (CWE)

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'): The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

[Architecture and Design] In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
[Architecture and Design] Use thread-safe capabilities such as the data access abstraction in Spring.

Source: MITRE CWE corpus.