CVE-2026-27007: OpenClaw Configuration Integrity Issue Due to Array Sorting
Summary
CVE-2026-27007: OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation. Affects openclaw versions < 2026.2.15. Fixed in 2026.2.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source tool designed for managing sandbox environments, allowing users to configure and deploy containers efficiently. It provides various features for sandbox management, including the ability to customize configurations for networking and storage. However, a vulnerability was discovered in its configuration hashing mechanism that affects the integrity of sandbox recreation.
Vulnerability Detail
The vulnerability arises from the normalizeForHash function in the OpenClaw codebase, which recursively sorts arrays containing only primitive values. This sorting leads to order-sensitive configuration arrays hashing to the same value, even when their order changes. Consequently, changes in the order of configuration parameters, such as Docker's dns and binds arrays, may not trigger the recreation of sandbox containers. This can result in stale containers being reused, posing a risk to the integrity and reliability of the sandbox environment.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.15
This is the first release that contains the fix.
npm install openclaw@2026.2.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually ensure that the order of configuration arrays remains consistent across deployments. However, this is not a long-term solution and updating to the patched version is strongly recommended.
Conclusion
The OpenClaw vulnerability CVE-2026-27007 poses a significant risk to the integrity of sandbox configurations due to improper handling of array ordering in hash normalization. Users are advised to update to the patched version 2026.2.15 or later to ensure the reliability of their sandbox environments.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability can lead to stale containers being reused due to unchanged hashes, which may compromise the integrity of the sandbox environment.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
If immediate updates are not possible, ensure that the order of configuration arrays remains consistent to mitigate the risk temporarily.
The vulnerability was reported by @kexinoh from Tencent zhuque Lab.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
