CVE-2026-28479 affects OpenClaw, the npm package, in versions before 2026.2.15. It is rated high severity (CVSS 7.5) because sandbox cache keys were built with SHA-1, a hash with known collision weaknesses. The fix replaces SHA-1 with SHA-256. Upgrade to 2026.2.15 or later.
What's affected
The GitHub advisory lists the npm package openclaw at version 2026.2.14 and earlier as affected. The fixed version is 2026.2.15.
The weak hash sits in the code that builds an identifier for Docker and browser sandbox configurations. That identifier decides whether an existing sandbox container can be reused.
How to check if you're exposed
Find the installed version in each project that depends on OpenClaw:
npm ls openclaw
For a global install, run npm ls -g openclaw. Any result at 2026.2.14 or earlier needs the update. You can also paste a lockfile into the free in-browser dependency scan to see every affected project at once.
What to do now
- Upgrade
openclawto 2026.2.15 or later and commit the updated lockfile. - Rebuild and redeploy anything that ships the package, including images that bundle it.
- If you run long-lived sandboxes, recreate them after the upgrade so no container created under the old cache identity is reused.
- Add a dependency check to CI so the next advisory in your tree is flagged on the pull request.
Why it matters
The flaw is a use of a weak hash, class CWE-327 (use of a broken or risky cryptographic algorithm). In this code path the hash is not protecting a password. It is naming a sandbox configuration so the tool can decide whether an existing container is safe to reuse.
If two different configurations produced the same SHA-1 value, one could be mistaken for the other, and a sandbox could be reused with the wrong state. The advisory frames this as increased risk of cache poisoning and unsafe sandbox reuse. It does not describe active exploitation, and the record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Does this CVE mean SHA-1 is broken everywhere in OpenClaw?
The advisory is specific to the hash used for the sandbox identifier cache key. The fix moved those deterministic hashes to SHA-256. Check the release notes if you need to know about other uses.
Sources
Last reviewed: 19 October 2026.
