CVE-2026-28479
OpenClaw replaced a deprecated sandbox hash algorithm
描述
## Affected Packages / Versions - npm package: `openclaw` - Affected versions: `<= 2026.2.14` - Fixed version (pre-set): `2026.2.15` ## Description The sandbox identifier cache key for Docker/browser sandbox configuration used SHA-1 to hash normalized configuration payloads. SHA-1 is deprecated for cryptographic use and has known collision weaknesses. In this code path, deterministic IDs are used to decide whether an existing sandbox container can be reused safely. A collision in this hash could let one configuration be interpreted as another under the same sandbox cache identity, increasing the risk of cache poisoning and unsafe sandbox state reuse. The implementation now uses SHA-256 for these deterministic hashes to restore collision resistance for this security-relevant identifier path. ## Fix Commit(s) - `559c8d993` ## Release Process Note `patched_versions` is pre-set to `2026.2.15` for the next release. After that release is published, mark this advisory ready for publication. Thanks @kexinoh ( of Tencent zhuque Lab, by https://github.com/Tencent/AI-Infra-Guard) for reporting.
如何修補 CVE-2026-28479
要修補 CVE-2026-28479,請將受影響套件升級到下列已修補版本。
- —升級至 2026.2.15 或更新版本
CVE-2026-28479 正在被利用嗎?
低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 2026.2.15
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |