Executive brief
OpenClaw is a sandbox execution environment that prevents untrusted code from accessing the host network. However, a configuration flaw allows sandboxes to join other containers' networks via the docker.network=container parameter, potentially exposing privileged internal services. This requires an authenticated operator with configuration access, but if exploited could allow lateral movement to reach services that should be isolated.
Technical details
OpenClaw's sandbox network hardening validates the docker.network parameter to block network=host, but fails to restrict network=container:<id>, allowing sandboxes to join arbitrary container network namespaces. The vulnerability exists in the validateNetworkMode() function which only blocks "host" while forwarding other values directly to Docker create arguments. An attacker with trusted-operator access to configuration (e.g., agents.defaults.sandbox.docker.network) can specify a container ID to join that namespace and reach internal or privileged services. The fix, available in version 2026.2.24, implements strict allowlisting of safe network modes and blocks all namespace-join patterns including container:<id>.
Affected products
- OpenClaw OpenClaw <= 2026.2.23
Timeline
- 2026-02-25: disclosed
- 2026-02-25: patched: Fixed in version 2026.2.24