Every CVESearch/Get API key

CVE-2026-27002

OpenClaw: Docker container escape via unvalidated bind mount config injection

7.7 HighFix available

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building docker create args; config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths, keep agents.*.sandbox.docker.network at none (default) or bridge, and do not use unconfined for seccomp/AppArmor profiles.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.53%Up 0.5 points since Feb 20, 2026
90%50%10%1%

What each source reports

CVE List Score used7.7

OpenClaw: Docker container escape via unvalidated bind mount config injection

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building docker create args; config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths, keep agents.*.sandbox.docker.network at none (default) or bridge, and do not use unconfined for seccomp/AppArmor profiles.

Record
CVE-2026-27002
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-250
Updated
2026-11-02
EUVDEUVD-2026-84167.7

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building docker create args; config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths, keep agents.*.sandbox.docker.network at none (default) or bridge, and do not use unconfined for seccomp/AppArmor profiles.

Record
EUVD-2026-8416
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w235-x559-36mg7.7

OpenClaw: Docker container escape via unvalidated bind mount config injection

Summary

A configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.14
  • Fixed version: >= 2026.2.15 (next release)

Impact

If an attacker can influence sandbox Docker configuration (or an operator pastes untrusted config), they may be able to:

  • mount sensitive host paths (e.g. /etc, /proc, /sys, /dev, Docker socket)
  • use network=host to bypass container network isolation
  • use seccompProfile=unconfined / apparmorProfile=unconfined to weaken isolation

This can lead to host secret exfiltration or full host control (via Docker socket exposure).

Fix

OpenClaw now blocks dangerous sandbox Docker settings:

  • runtime enforcement when building docker create args
  • config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined
  • security audit findings to surface dangerous sandbox docker config

Workarounds

  • Do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths.
  • Keep agents.*.sandbox.docker.network at none (default) or bridge.
  • Do not use unconfined for seccomp/AppArmor profiles.

Fix Commit(s)

  • 887b209db47f1f9322fead241a1c0b043fd38339
  • 1b6704ef5800152c777ea52b77aa2c8a46c13705 (docs)

Release Process Note

This advisory is pre-populated with the planned fixed version (>= 2026.2.15). Once openclaw@2026.2.15 is published to npm, publishing this advisory should be a single-click action.

Thanks @aether-ai-agent for reporting.

Record
GHSA-w235-x559-36mg
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-250
Updated
2026-11-02
NVD7.7

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building docker create args; config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths, keep agents.*.sandbox.docker.network at none (default) or bridge, and do not use unconfined for seccomp/AppArmor profiles.

Record
CVE-2026-27002
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-250
Updated
2026-11-02
OSV7.7

OpenClaw: Docker container escape via unvalidated bind mount config injection

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building docker create args; config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths, keep agents.*.sandbox.docker.network at none (default) or bridge, and do not use unconfined for seccomp/AppArmor profiles.

Record
CVE-2026-27002
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-250
Updated
2026-11-11
OSVGHSA-w235-x559-36mg7.7

OpenClaw: Docker container escape via unvalidated bind mount config injection

Summary

A configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.14
  • Fixed version: >= 2026.2.15 (next release)

Impact

If an attacker can influence sandbox Docker configuration (or an operator pastes untrusted config), they may be able to:

  • mount sensitive host paths (e.g. /etc, /proc, /sys, /dev, Docker socket)
  • use network=host to bypass container network isolation
  • use seccompProfile=unconfined / apparmorProfile=unconfined to weaken isolation

This can lead to host secret exfiltration or full host control (via Docker socket exposure).

Fix

OpenClaw now blocks dangerous sandbox Docker settings:

  • runtime enforcement when building docker create args
  • config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined
  • security audit findings to surface dangerous sandbox docker config

Workarounds

  • Do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths.
  • Keep agents.*.sandbox.docker.network at none (default) or bridge.
  • Do not use unconfined for seccomp/AppArmor profiles.

Fix Commit(s)

  • 887b209db47f1f9322fead241a1c0b043fd38339
  • 1b6704ef5800152c777ea52b77aa2c8a46c13705 (docs)

Release Process Note

This advisory is pre-populated with the planned fixed version (>= 2026.2.15). Once openclaw@2026.2.15 is published to npm, publishing this advisory should be a single-click action.

Thanks @aether-ai-agent for reporting.

Record
GHSA-w235-x559-36mg
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-250
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
before 2026.2.15
2026.2.15

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27002 is a high vulnerability (CVSS 7.7) in Openclaw, published February 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in openclaw 2026.2.15.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open