CVE-2026-27007
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation
描述
## Description `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when order changed. In OpenClaw sandbox flows, this hash is used to decide whether existing sandbox containers should be recreated. As a result, order-only config changes (for example Docker `dns` and `binds` array order) could be treated as unchanged and stale containers could be reused. This is a configuration integrity issue affecting sandbox recreation behavior. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<=2026.2.14` - Patched (planned next release): `>=2026.2.15` - Latest published npm version at triage time (2026-02-16): `2026.2.14` ## Remediation Array ordering is now preserved during hash normalization; only object key ordering remains normalized for deterministic hashing. ## Fix Commit(s) - `41ded303b4f6dae5afa854531ff837c3276ad60b` ## Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.15`) so after npm publish, the advisory can be published directly without reopening version metadata edits. Thanks @kexinoh ( of Tencent zhuque Lab, by https://github.com/Tencent/AI-Infra-Guard) for reporting.
如何修補 CVE-2026-27007
要修補 CVE-2026-27007,請將受影響套件升級到下列已修補版本。
- —升級至 2026.2.15 或更新版本
CVE-2026-27007 正在被利用嗎?
低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 2026.2.15
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |