Every CVE Search/ Get API key

CVE-2026-32038

OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter

9.3 CriticalFix available

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id> values to reach services in target container namespaces and bypass network hardening controls.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.28%Up 0.2 points since Mar 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.3

OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id> values to reach services in target container namespaces and bypass network hardening controls.

Record
CVE-2026-32038
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-08
EUVDEUVD-2026-13324 9.3

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id> values to reach services in target container namespaces and bypass network hardening controls.

Record
EUVD-2026-13324
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-08
GitHub AdvisoriesGHSA-ww6v-v748-x7g9 6.9

OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

Summary

In [email protected], sandbox network hardening blocks network=host but still allows network=container:<id>.

This can let a sandbox join another container's network namespace and reach services available in that namespace.

Preconditions and Trust Model Context

This issue requires a trusted-operator configuration path (for example setting agents.defaults.sandbox.docker.network in gateway config). It is not an unauthenticated remote exploit by itself.

Details

Current validation blocks only host, while forwarding other values to Docker create args:

  • validateNetworkMode(network) only rejects values in BLOCKED_NETWORK_MODES = {"host"}.
  • buildSandboxCreateArgs(...) validates then forwards cfg.network into --network.
  • Browser sandbox helper also treats container: as an accepted mode in network preparation.

Effective behavior:

  • host -> blocked
  • container:<id> -> accepted and forwarded

Impact

Type: sandbox network isolation hardening bypass.

Practical impact depends on deployment:

  • Requires ability to influence trusted sandbox network config.
  • Higher impact when a target container exposes privileged/internal network reachability.

Remediation

Block namespace-join style network modes (including container:<id>) for sandbox containers, and keep strict allowlisting for safe network modes.

Patch Status

Fixed on main in commit 14b6eea6e: https://github.com/openclaw/openclaw/commit/14b6eea6e

Follow-up refactor/cleanup (no policy rollback): https://github.com/openclaw/openclaw/commit/5552f9073

Publication Update (2026-02-25)

[email protected] is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

Record
GHSA-ww6v-v748-x7g9
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-284, CWE-693
Updated
2026-11-02
NVD 9.3

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id> values to reach services in target container namespaces and bypass network hardening controls.

Record
CVE-2026-32038
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSV 9.3

OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id> values to reach services in target container namespaces and bypass network hardening controls.

Record
CVE-2026-32038
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-284
Updated
2026-11-09
OSVGHSA-ww6v-v748-x7g9 6.9

OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

Summary

In [email protected], sandbox network hardening blocks network=host but still allows network=container:<id>.

This can let a sandbox join another container's network namespace and reach services available in that namespace.

Preconditions and Trust Model Context

This issue requires a trusted-operator configuration path (for example setting agents.defaults.sandbox.docker.network in gateway config). It is not an unauthenticated remote exploit by itself.

Details

Current validation blocks only host, while forwarding other values to Docker create args:

  • validateNetworkMode(network) only rejects values in BLOCKED_NETWORK_MODES = {"host"}.
  • buildSandboxCreateArgs(...) validates then forwards cfg.network into --network.
  • Browser sandbox helper also treats container: as an accepted mode in network preparation.

Effective behavior:

  • host -> blocked
  • container:<id> -> accepted and forwarded

Impact

Type: sandbox network isolation hardening bypass.

Practical impact depends on deployment:

  • Requires ability to influence trusted sandbox network config.
  • Higher impact when a target container exposes privileged/internal network reachability.

Remediation

Block namespace-join style network modes (including container:<id>) for sandbox containers, and keep strict allowlisting for safe network modes.

Patch Status

Fixed on main in commit 14b6eea6e: https://github.com/openclaw/openclaw/commit/14b6eea6e

Follow-up refactor/cleanup (no policy rollback): https://github.com/openclaw/openclaw/commit/5552f9073

Publication Update (2026-02-25)

[email protected] is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

Record
GHSA-ww6v-v748-x7g9
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-284, CWE-693
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 through 2026.2.23
2026.2.24
openclaw
npm
 before 2026.2.24
2026.2.24

History

History
RecordedChangedSources
factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32038 is a critical vulnerability (CVSS 9.3) in Openclaw, published March 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in openclaw 2026.2.24.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open