CVE-2026-27007
OpenClaw is a personal AI assistant.
Published Feb 20, 2026 · updated Jun 17, 2026 · openclaw openclaw
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when order changed. In OpenClaw sandbox flows, this hash is used to decide whether existing sandbox containers should be recreated. As a result, order-only config changes (for example Docker and array order) could be treated as unchanged and stale containers could be reused. This is a configuration integrity issue affecting sandbox recreation behavior. Starting in version 2026.2.15, array ordering is preserved during hash normalization; only object key ordering remains normalized for deterministic hashing.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 20, 2026 · NIST NVD
Detected
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when order changed. In OpenClaw sandbox flows, this hash is used to decide whether existing sandbox containers should be recreated. As a result, order-only config changes (for example D
Jun 17, 2026 · NIST NVD
Updated
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when order changed. In OpenClaw sandbox flows, this hash is used to decide whether existing sandbox containers should be recreated. As a result, order-only config changes (for example D
Affected
- cpe openclaw/openclawversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27007
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27007
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when order
nvd.nist.gov