Skip to content
AI Sec Watch
HighVulnerability

GHSA-w235-x559-36mg: OpenClaw: Docker container escape via unvalidated bind mount config injection

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-27002GHSA-w235-x559-36mg
Published
Record updated
View JSON
Affected
  • openclaw < 2026.2.15
Fixed in
2026.2.15
  • released February 15, 2026, 2 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.5%

Summary

The openclaw npm package, in versions up to and including 2026.2.14, lets dangerous Docker options be applied to its Docker tool sandbox through unvalidated configuration injection. An attacker who can influence sandbox Docker configuration, or an operator who pastes untrusted config, can mount sensitive host paths, set network=host, or use unconfined seccomp or AppArmor profiles. This can lead to host secret exfiltration or full host control via Docker socket exposure. The fixed version is 2026.2.15 (next release).

Mitigation

Fixed in >= 2026.2.15 (next release): OpenClaw now blocks dangerous sandbox Docker settings through runtime enforcement when building docker create args, config-schema validation for network=host, seccompProfile=unconfined and apparmorProfile=unconfined, and security audit findings for dangerous sandbox docker config. Workarounds: do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths, keep agents.*.sandbox.docker.network at none (default) or bridge, and do not use unconfined for seccomp or AppArmor profiles.

Related items