EUVD-2026-103175

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/containerregistryservice.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:updat...

Arcane Information Leak Vulnerability

Versions of Arcane 2.5.0 and earlier contain security vulnerabilities. These vulnerabilities stem from the UpdateRegistry and TestRegistry functions, which allow changing the registry URL while retaining the stored encrypted tokens. There are no restrictions on the target addresses, which may lea...

CVE-2026-32018

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data...

CVE-2026-32018: Concurrent Execution using Shared Resource with Improper Synchronization

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking to cause registry updates to lose data...

PT-2026-25459

Impact Concurrent updateRegistry/removeRegistryEntry operations for sandbox containers and browsers could lose updates or resurrect removed entries under race conditions. The registry writes were read-modify-write in a window with no locking and permissive fallback parsing, so concurrent registry...