CVE-2026-27002: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27002 is a configuration injection vulnerability in OpenClaw, a personal AI assistant, affecting the Docker tool sandbox. Prior to version 2026.2.15, the application failed to validate or restrict dangerous Docker options — including bind mounts to sensitive host paths, host networking mode, and unconfined seccomp/AppArmor profiles — allowing container escape or unauthorized host data access. The vulnerability affects all OpenClaw (npm) versions prior to 2026.2.15 and was disclosed on February 18, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory).

The root cause is classified as CWE-250 (Execution with Unnecessary Privileges): OpenClaw's buildSandboxCreateArgs function passed Docker configuration options directly to docker create without validating or blocking dangerous settings (GitHub Advisory). An attacker who can influence the sandbox Docker configuration — either by injecting untrusted config or by an operator pasting malicious configuration — can specify bind mounts targeting sensitive host paths (e.g., /etc, /proc, /var/run/docker.sock), set network=host to bypass container network isolation, or set seccompProfile=unconfined / apparmorProfile=unconfined to weaken kernel-level isolation. The fix introduced a validateSandboxSecurity() function called at runtime before building docker create arguments, with explicit blocklists for dangerous bind paths (including symlink traversal and path normalization checks), host network mode, and unconfined profiles (Fix Commit).

Successful exploitation can result in full container escape, granting an attacker access to the underlying host system. Specific consequences include exfiltration of sensitive host secrets and credentials (via bind-mounting /etc, /proc, or other sensitive paths), full host control through Docker socket exposure (/var/run/docker.sock), bypassing container network isolation via network=host, and weakening kernel security enforcement by disabling seccomp or AppArmor profiles. This can lead to lateral movement across the host and any other containers or services running on it (GitHub Advisory, GitHub Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04% (7th percentile), indicating a low near-term exploitation probability. Exploitation requires the ability to influence the OpenClaw agent sandbox Docker configuration, either through direct configuration access or by tricking an operator into applying untrusted configuration.

1. Identify target: Locate an OpenClaw deployment running a version prior to 2026.2.15 (npm package openclaw < 2026.2.15) with an externally accessible or operator-configurable agent sandbox.
2. Craft malicious configuration: Prepare a malicious agent configuration targeting the agents.*.sandbox.docker section, specifying one or more dangerous options:
   • binds: ["/var/run/docker.sock:/var/run/docker.sock"] to expose the Docker socket inside the container
   • network: "host" to bypass container network isolation
   • seccompProfile: "unconfined" or apparmorProfile: "unconfined" to disable kernel security profiles
3. Inject or deliver configuration: Either directly modify the OpenClaw configuration file if access is available, or social-engineer an operator into pasting the malicious config block.
4. Trigger sandbox creation: Cause OpenClaw to spawn a new agent sandbox (e.g., by initiating an agent task), which calls buildSandboxCreateArgs() and passes the unvalidated dangerous options to docker create.
5. Escape the container: Once the container is running with the Docker socket mounted, use the Docker API from within the container (e.g., docker run -v /:/host --rm -it alpine chroot /host) to gain root access on the host system, exfiltrate secrets, or pivot to other containers (GitHub Advisory, Fix Commit).

• Docker/Process: Unexpected docker create or docker run commands with -v /var/run/docker.sock:/var/run/docker.sock, -v /etc:/..., -v /proc:/..., or --network host flags spawned by the OpenClaw process.
• Docker/Process: Containers launched with --security-opt seccomp=unconfined or --security-opt apparmor=unconfined associated with OpenClaw sandbox prefixes (e.g., openclaw-sbx-*).
• File System: Unexpected access to host paths such as /etc/passwd, /etc/shadow, /proc, /sys, or /dev from within a container process.
• Network: Outbound connections from the OpenClaw sandbox container to external hosts that would normally be blocked by network=none or network=bridge isolation.
• Logs: Docker daemon logs showing docker create commands with dangerous bind mounts or host networking for containers named with the openclaw-sbx- prefix.
• Process: Child processes of the Docker container (e.g., docker, chroot, nsenter) accessing host filesystem paths or the Docker socket.

Upgrade OpenClaw to version 2026.2.15 or later, which introduces runtime enforcement in buildSandboxCreateArgs() blocking dangerous bind mounts, host network mode, and unconfined seccomp/AppArmor profiles (GitHub Release, Fix Commit). If immediate patching is not possible, apply the following configuration workarounds:

• Do not configure agents.*.sandbox.docker.binds to mount system directories (/etc, /proc, /sys, /dev) or the Docker socket (/var/run/docker.sock).
• Keep agents.*.sandbox.docker.network at none (default) or bridge; never set it to host.
• Do not set seccompProfile or apparmorProfile to unconfined (GitHub Advisory).

The vulnerability was reported by @aether-ai-agent and disclosed by maintainer orlyjamie on February 18, 2026 (GitHub Advisory). Security blog Infinit Security published a technical write-up on the container escape mechanism, and BaseFortify published a broader analysis titled "OpenClaw: loads of CVEs published — an agent reality check," contextualizing this and related CVEs within the emerging agentic AI security landscape. SecDim published a blog post titled "Dangerous by Default: What OpenClaw CVE Record Tells Us About Agentic AI," highlighting the systemic risk of insecure defaults in AI agent frameworks. The vulnerability was also picked up by The Hacker Wire and shared on Bluesky, reflecting moderate community interest in AI agent sandbox security.