OpenClaw versions prior to 2026.2.19 contain a race condition between concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. The lack of synchronization for read‑modify‑write sequences allows attackers to cause registry updates to lose data, resurrect removed entries, or corrupt the sandbox state, impacting list, prune, and recreate operations. This weakness is identified as CWE‑362.

Affected systems are installations of OpenClaw running any version before 2026.2.19, as indicated by the known version information. The vendor product is OpenClaw:OpenClaw as listed in the CPE string.

The CVSS score for this vulnerability is 2.0, indicating low severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires concurrent access to registry update functions, the likely attack vector involves an attacker who can trigger simultaneous sandbox or browser sessions. While the immediate risk to confidentiality is low, the integrity and availability of sandbox configurations can be compromised if the race condition is exploited.