CVE-2026-28479

OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vulnerable to collision attacks. An attacker can exploit SHA-1 collisions to cause cache poisoning, allowing one sandbox configuration to be misinterpreted as another and enabling unsafe sandbox state reuse.

Affected products

Docker, Openclaw

Openclaw

< 2026.2.15

Fix

Available

CVSS 3.1

9.1 CRITICAL

EPSS

0.2% (8th percentile)

Weakness

CWE-327

NVD status

Analyzed

Published

2026-03-05

No exploit for CVE-2026-28479 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.