Vulnerabilities

TI-2026-22748 CVE-2026-28479 · GHSA-fh3f-q9qw-93j9

OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration

MEDIUM 43

OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vulnerable to collision attacks.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00208 Published 2026-03-05 Fixed in 2026.2.15 CWE-327

TI-2026-22669 CVE-2026-28394 · GHSA-p536-vvpp-9mc8

OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool

LOW 31

OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML…

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00462 Published 2026-03-05 Fixed in 2026.2.15 CWE-770

Vulnerabilities

Filters

OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration

OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool