CVE-2026-27007 Details
Description
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when order changed. In OpenClaw sandbox flows, this hash is used to decide whether existing sandbox containers should be recreated. As a result, order-only config changes (for example Docker `dns` and `binds` array order) could be treated as unchanged and stale containers could be reused. This is a configuration integrity issue affecting sandbox recreation behavior. Starting in version 2026.2.15, array ordering is preserved during hash normalization; only object key ordering remains normalized for deterministic hashing.
A configuration integrity vulnerability has been identified in OpenClaw, a personal AI assistant, in versions prior to 2026.2.15. The issue arises in the 'normalizeForHash' function, which recursively sorted arrays of primitive values. This sorting caused order-sensitive sandbox configuration arrays to hash identically, disregarding any changes in order. In OpenClaw's sandbox workflows, this hash determines whether to recreate existing sandbox containers. Consequently, changes that only affected array order, such as Docker 'dns' and 'binds' settings, were not recognized, leading to the reuse of outdated containers. This vulnerability disrupts the expected behavior of sandbox recreation.
Users can update to OpenClaw version 2026.2.15 or later, where this vulnerability has been patched. The latest version can be downloaded from the OpenClaw GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1254 | Incorrect Comparison Logic Granularity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.2.15 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 20, 2026 | Initial Analysis | [email protected] |
| Feb 20, 2026 | New CVE Received | [email protected] |