CVE-2026-27007: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27007 is a configuration integrity vulnerability in the OpenClaw npm package affecting all versions prior to 2026.2.15. The flaw resides in the normalizeForHash function in src/agents/sandbox/config-hash.ts, which incorrectly sorted primitive-only arrays during hash computation, causing order-sensitive sandbox configuration arrays (e.g., Docker dns and binds) to produce identical hashes regardless of element order. This allowed stale sandbox containers to be reused when only array ordering changed, bypassing intended container recreation logic. Disclosed on February 18, 2026, and published to the NVD on February 20, 2026, it carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory).

The root cause is classified as CWE-1254 (Incorrect Comparison Logic Granularity): the normalizeForHash function in config-hash.ts applied lexicographic sorting to arrays containing only primitive values before hashing, treating ["1.1.1.1", "8.8.8.8"] and ["8.8.8.8", "1.1.1.1"] as equivalent. Since OpenClaw uses this hash to determine whether sandbox containers need to be recreated, an attacker or misconfiguration that reorders array elements (such as Docker DNS servers or bind mount entries) would not trigger container recreation. The attack vector is local and requires low privileges — an attacker must be able to modify sandbox configuration files on the host system. The fix, committed in 41ded303b4f6dae5afa854531ff837c3276ad60b, removes the primitive-array sorting logic so that array order is preserved during normalization, while object key ordering remains normalized for deterministic hashing (GitHub Commit, GitHub Advisory).

Successful exploitation allows a local attacker with low privileges to cause sandbox configuration changes to be silently ignored, resulting in stale or outdated Docker containers being reused instead of recreated with the intended configuration. This can lead to inconsistent sandbox behavior, persistence of previously applied (potentially insecure) container settings, bypassed security controls tied to specific DNS or bind mount configurations, and unintended resource access patterns within the sandbox environment. Confidentiality and availability are not directly impacted; the primary risk is to configuration integrity within the OpenClaw sandbox (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0th percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local access and low privileges, further limiting the practical attack surface (GitHub Advisory, Feedly).

1. Gain local access: Obtain low-privilege local access to a system running OpenClaw version ≤ 2026.2.14 with sandbox Docker flows enabled.
2. Locate sandbox configuration: Identify the sandbox configuration file(s) that define Docker dns or binds arrays used by OpenClaw's sandbox agent.
3. Reorder array elements: Modify the configuration to reorder elements within a primitive array (e.g., swap DNS server order from ["1.1.1.1", "8.8.8.8"] to ["8.8.8.8", "1.1.1.1"]) while keeping the same values.
4. Trigger sandbox evaluation: Cause OpenClaw to evaluate the sandbox configuration hash (e.g., by initiating a new agent run or sandbox flow).
5. Observe stale container reuse: Because the flawed normalizeForHash function sorts primitive arrays before hashing, the new configuration produces the same hash as the old one, and OpenClaw reuses the existing container without applying the intended configuration change — preserving the prior (potentially insecure) container state (GitHub Advisory, GitHub Commit).

• Logs: OpenClaw sandbox logs showing container reuse decisions ("container unchanged, reusing") immediately after configuration array reordering changes were applied — particularly for dns or binds fields.
• File System: Unexpected or unauthorized modifications to OpenClaw sandbox configuration files (e.g., reordered dns or binds arrays) without corresponding container recreation events in logs.
• Process/Container: Running Docker containers whose configuration does not match the current sandbox config file contents, indicating stale container reuse; verifiable by comparing docker inspect output against the active configuration.

Upgrade OpenClaw (npm package) to version 2026.2.15 or later, which preserves array order during hash normalization and correctly triggers container recreation on order-only configuration changes (GitHub Release, GitHub Advisory). No configuration-based workaround is available for the hashing flaw itself; upgrading is the only remediation. As a compensating control, restrict write access to sandbox configuration files to authorized administrators only, and periodically audit running container configurations against expected settings to detect stale container reuse.

The vulnerability was reported by researcher @kexinoh of Tencent Zhuque Lab via the AI-Infra-Guard project, and credited in both the GitHub advisory and the v2026.2.15 release notes. The fix was published promptly by maintainer @steipete on February 18, 2026. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability database aggregation (GitHub Advisory, GitHub Release).