GHSA-w235-x559-36mg

Suggest an improvement
Source
https://github.com/advisories/GHSA-w235-x559-36mg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w235-x559-36mg/GHSA-w235-x559-36mg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w235-x559-36mg
Aliases
Published
2026-02-18T22:42:42Z
Modified
2026-02-20T17:03:57.575645Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw: Docker container escape via unvalidated bind mount config injection
Details

Summary

A configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.14
  • Fixed version: >= 2026.2.15 (next release)

Impact

If an attacker can influence sandbox Docker configuration (or an operator pastes untrusted config), they may be able to: - mount sensitive host paths (e.g. /etc, /proc, /sys, /dev, Docker socket) - use network=host to bypass container network isolation - use seccompProfile=unconfined / apparmorProfile=unconfined to weaken isolation

This can lead to host secret exfiltration or full host control (via Docker socket exposure).

Fix

OpenClaw now blocks dangerous sandbox Docker settings: - runtime enforcement when building docker create args - config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined - security audit findings to surface dangerous sandbox docker config

Workarounds

  • Do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths.
  • Keep agents.*.sandbox.docker.network at none (default) or bridge.
  • Do not use unconfined for seccomp/AppArmor profiles.

Fix Commit(s)

  • 887b209db47f1f9322fead241a1c0b043fd38339
  • 1b6704ef5800152c777ea52b77aa2c8a46c13705 (docs)

Release Process Note

This advisory is pre-populated with the planned fixed version (>= 2026.2.15). Once openclaw@2026.2.15 is published to npm, publishing this advisory should be a single-click action.

Thanks @aether-ai-agent for reporting.

Database specific 
{
    "github_reviewed_at": "2026-02-18T22:42:42Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-250"
    ],
    "nvd_published_at": "2026-02-20T00:16:16Z",
    "severity": "HIGH"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.2.15

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w235-x559-36mg/GHSA-w235-x559-36mg.json"