OpenClaw versions prior to 2026.2.15 are susceptible to a cryptographic vulnerability that allows remote attackers to perform cache poisoning attacks against sandbox identifiers.

This vulnerability involves the use of the deprecated SHA-1 cryptographic algorithm for hashing sandbox identifier cache keys. An unauthenticated attacker can exploit this weakness to generate hash collisions, resulting in cache poisoning and the potential for unauthorized sandbox state reuse.

The use of a deprecated hashing algorithm poses a significant risk to the integrity of sandbox environments. Successful exploitation allows an attacker to manipulate cache entries, potentially leading to unauthorized cross-sandbox state access or configuration misinterpretation. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent potential data exposure or sandbox breakout scenarios.

Immediate Action: Update the OpenClaw package to version 2026.2.15 or later to replace the insecure hashing mechanism with a cryptographically secure alternative.

Proactive Monitoring: Monitor application logs for unusual sandbox behavior or repeated cache access errors that may indicate collision-based exploitation attempts.

Compensating Controls: While no direct WAF rule can address this cryptographic flaw, ensure that the application environment is isolated and that access to the affected sandbox configuration service is restricted to authorized processes.

Public Exploit Available: Unknown.

Given the high CVSS severity and the ease of exploitation (as indicated by the CVSS vector's low attack complexity and no required authentication), administrators must prioritize patching this vulnerability. Upgrading to version 2026.2.15 is the only effective way to remediate the underlying cryptographic risk and ensure the continued integrity of your sandbox environments.