Executive brief
OpenClaw is an npm package that manages Docker container sandboxes for secure code execution. A configuration injection flaw allows attackers who can modify sandbox settings to mount sensitive host directories (like /etc or /proc), use host networking, or disable security profiles. This enables escaping the container, accessing host secrets, or gaining full control of the underlying system.
Technical details
The vulnerability is a configuration injection issue (CWE-250) in OpenClaw's Docker sandbox configuration handling. The root cause is insufficient validation of bind mount settings, network isolation mode, and security profiles (seccomp and AppArmor) before constructing Docker container creation arguments. An attacker who can influence the sandbox Docker configuration (via config file manipulation or operator error) can inject dangerous options such as bind mounts to system paths, network=host mode, or unconfined security profiles. Attack preconditions require configuration-level access—this is not a network exploit, but rather a sandbox escape if an attacker already has some control over deployment configuration. Successful exploitation leads to host secret exfiltration or complete host compromise via Docker socket exposure. The fix is available in version 2026.2.15, which adds runtime enforcement, config schema validation, and security audit logging to prevent dangerous settings.
Affected products
- OpenClaw openclaw <= 2026.2.14
Timeline
- 2026-02-18: disclosed: Vulnerability published
- 2026-02-15: patched: Fix released in version 2026.2.15