{"id":"CVE-2026-27002","aliases":["EUVD-2026-8416","GHSA-w235-x559-36mg"],"status":"published","title":"OpenClaw: Docker container escape via unvalidated bind mount config injection","description":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building `docker create` args; config-schema validation for `network=host`, `seccompProfile=unconfined`, `apparmorProfile=unconfined`; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure `agents.*.sandbox.docker.binds` to mount system directories or Docker socket paths, keep `agents.*.sandbox.docker.network` at `none` (default) or `bridge`, and do not use `unconfined` for seccomp/AppArmor profiles.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00528,"percentile":0.4521,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-250"],"published":"2026-02-18T22:42:42Z","modified":"2026-11-04T02:51:07Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.2.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.2.15"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.15"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w235-x559-36mg","tags":["x_refsource_CONFIRM","Mitigation","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/commit/887b209db47f1f9322fead241a1c0b043fd38339","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.15","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27002","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w235-x559-36mg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27002.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-27002","title":"OpenClaw: Docker container escape via unvalidated bind mount config injection","description":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building `docker create` args; config-schema validation for `network=host`, `seccompProfile=unconfined`, `apparmorProfile=unconfined`; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure `agents.*.sandbox.docker.binds` to mount system directories or Docker socket paths, keep `agents.*.sandbox.docker.network` at `none` (default) or `bridge`, and do not use `unconfined` for seccomp/AppArmor profiles.","status":"published","published":"2026-02-19T23:12:17.481Z","modified":"2026-02-20T15:38:01.647Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-8416","description":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building `docker create` args; config-schema validation for `network=host`, `seccompProfile=unconfined`, `apparmorProfile=unconfined`; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure `agents.*.sandbox.docker.binds` to mount system directories or Docker socket paths, keep `agents.*.sandbox.docker.network` at `none` (default) or `bridge`, and do not use `unconfined` for seccomp/AppArmor profiles.","status":"published","published":"2026-02-19T23:12:17Z","modified":"2026-02-20T15:38:01Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:37.056368Z"}],"ghsa":[{"id":"GHSA-w235-x559-36mg","title":"OpenClaw: Docker container escape via unvalidated bind mount config injection","description":"## Summary\nA configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.14`\n- Fixed version: `\u003e= 2026.2.15` (next release)\n\n## Impact\nIf an attacker can influence sandbox Docker configuration (or an operator pastes untrusted config), they may be able to:\n- mount sensitive host paths (e.g. `/etc`, `/proc`, `/sys`, `/dev`, Docker socket)\n- use `network=host` to bypass container network isolation\n- use `seccompProfile=unconfined` / `apparmorProfile=unconfined` to weaken isolation\n\nThis can lead to host secret exfiltration or full host control (via Docker socket exposure).\n\n## Fix\nOpenClaw now blocks dangerous sandbox Docker settings:\n- runtime enforcement when building `docker create` args\n- config-schema validation for `network=host`, `seccompProfile=unconfined`, `apparmorProfile=unconfined`\n- security audit findings to surface dangerous sandbox docker config\n\n## Workarounds\n- Do not configure `agents.*.sandbox.docker.binds` to mount system directories or Docker socket paths.\n- Keep `agents.*.sandbox.docker.network` at `none` (default) or `bridge`.\n- Do not use `unconfined` for seccomp/AppArmor profiles.\n\n## Fix Commit(s)\n- 887b209db47f1f9322fead241a1c0b043fd38339\n- 1b6704ef5800152c777ea52b77aa2c8a46c13705 (docs)\n\n## Release Process Note\nThis advisory is pre-populated with the planned fixed version (`\u003e= 2026.2.15`). Once `openclaw@2026.2.15` is published to npm, publishing this advisory should be a single-click action.\n\nThanks @aether-ai-agent for reporting.","status":"published","published":"2026-02-18T22:42:42Z","modified":"2026-02-20T16:47:05Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:39:26.881079Z"}],"nvd":[{"id":"CVE-2026-27002","description":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building `docker create` args; config-schema validation for `network=host`, `seccompProfile=unconfined`, `apparmorProfile=unconfined`; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure `agents.*.sandbox.docker.binds` to mount system directories or Docker socket paths, keep `agents.*.sandbox.docker.network` at `none` (default) or `bridge`, and do not use `unconfined` for seccomp/AppArmor profiles.","status":"published","published":"2026-02-20T00:16:16.827Z","modified":"2026-06-17T10:26:31.113Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:12:06.63895Z"}],"osv":[{"id":"CVE-2026-27002","title":"OpenClaw: Docker container escape via unvalidated bind mount config injection","description":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. OpenClaw 2026.2.15 blocks dangerous sandbox Docker settings and includes runtime enforcement when building `docker create` args; config-schema validation for `network=host`, `seccompProfile=unconfined`, `apparmorProfile=unconfined`; and security audit findings to surface dangerous sandbox docker config. As a workaround, do not configure `agents.*.sandbox.docker.binds` to mount system directories or Docker socket paths, keep `agents.*.sandbox.docker.network` at `none` (default) or `bridge`, and do not use `unconfined` for seccomp/AppArmor profiles.","status":"published","published":"2026-02-19T23:12:17.481Z","modified":"2026-11-11T10:30:28.100500739Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-250"],"updated_at":"2026-11-11T11:06:43.133992Z"},{"id":"GHSA-w235-x559-36mg","title":"OpenClaw: Docker container escape via unvalidated bind mount config injection","description":"## Summary\nA configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.14`\n- Fixed version: `\u003e= 2026.2.15` (next release)\n\n## Impact\nIf an attacker can influence sandbox Docker configuration (or an operator pastes untrusted config), they may be able to:\n- mount sensitive host paths (e.g. `/etc`, `/proc`, `/sys`, `/dev`, Docker socket)\n- use `network=host` to bypass container network isolation\n- use `seccompProfile=unconfined` / `apparmorProfile=unconfined` to weaken isolation\n\nThis can lead to host secret exfiltration or full host control (via Docker socket exposure).\n\n## Fix\nOpenClaw now blocks dangerous sandbox Docker settings:\n- runtime enforcement when building `docker create` args\n- config-schema validation for `network=host`, `seccompProfile=unconfined`, `apparmorProfile=unconfined`\n- security audit findings to surface dangerous sandbox docker config\n\n## Workarounds\n- Do not configure `agents.*.sandbox.docker.binds` to mount system directories or Docker socket paths.\n- Keep `agents.*.sandbox.docker.network` at `none` (default) or `bridge`.\n- Do not use `unconfined` for seccomp/AppArmor profiles.\n\n## Fix Commit(s)\n- 887b209db47f1f9322fead241a1c0b043fd38339\n- 1b6704ef5800152c777ea52b77aa2c8a46c13705 (docs)\n\n## Release Process Note\nThis advisory is pre-populated with the planned fixed version (`\u003e= 2026.2.15`). Once `openclaw@2026.2.15` is published to npm, publishing this advisory should be a single-click action.\n\nThanks @aether-ai-agent for reporting.","status":"published","published":"2026-02-18T22:42:42Z","modified":"2026-02-20T17:03:57.575645Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}