CVE-2026-32038: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32038 is a sandbox network isolation bypass vulnerability in OpenClaw (npm package) affecting all versions before 2026.2.24. The flaw allows trusted operators to configure the docker.network parameter with container:<id> values, enabling a sandbox container to join another container's network namespace and access services that should be isolated. It was published on March 19, 2026, with the patch released in OpenClaw version 2026.2.24 on February 25, 2026. The vulnerability carries a CVSS v3.1 base score of 9.0 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, VulnCheck).

The root cause is improper access control (CWE-284) and protection mechanism failure (CWE-693) in OpenClaw's network mode validation logic. The validateNetworkMode() function only blocks host via a hardcoded BLOCKED_NETWORK_MODES = {"host"} set, while container:<id> values are accepted and forwarded directly to Docker's --network argument via buildSandboxCreateArgs(). The browser sandbox helper similarly treats container: as an accepted mode during network preparation. Exploitation requires the ability to influence the trusted sandbox network configuration (e.g., setting agents.defaults.sandbox.docker.network in the gateway config), meaning it is not a fully unauthenticated remote exploit in isolation (GitHub Advisory).

Successful exploitation allows an attacker-controlled sandbox container to join another container's network namespace, effectively bypassing network hardening controls designed to isolate containerized workloads. This can lead to unauthorized access to internal services, data exfiltration from isolated containers, integrity compromise of services running in other namespaces, and lateral movement across containerized infrastructure. The practical impact is highest in deployments where target containers expose privileged or internal network services (GitHub Advisory, VulnCheck).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires the ability to influence trusted sandbox network configuration, limiting the attack surface to operators or processes with access to gateway configuration. The EPSS score is approximately 0.041%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, VulnCheck).

1. Identify target deployment: Locate an OpenClaw deployment running version <= 2026.2.23 where the attacker has access to the trusted operator configuration path (e.g., gateway config or agents.defaults.sandbox.docker.network setting).
2. Identify target container: Enumerate running Docker containers on the host to identify a target container ID (<id>) whose network namespace contains services of interest (e.g., internal APIs, databases).
3. Configure malicious network parameter: Set the docker.network parameter to container:<id> in the sandbox configuration (e.g., via agents.defaults.sandbox.docker.network: container:<target_container_id>).
4. Trigger sandbox creation: Cause OpenClaw to create a new sandbox container using the malicious configuration. The buildSandboxCreateArgs() function will pass --network container:<id> to Docker without blocking it.
5. Access target namespace services: From within the newly created sandbox container, access services bound to localhost or internal interfaces in the target container's network namespace, bypassing network isolation controls (GitHub Advisory).

• Docker/Container: Sandbox containers launched with --network container:<id> arguments visible in Docker daemon logs or via docker inspect; unexpected containers sharing network namespaces with sensitive workloads.
• Logs: OpenClaw gateway logs showing docker.network configuration values containing container: prefixes; unusual sandbox creation events referencing external container IDs.
• Network: Unexpected inter-container traffic between sandbox containers and previously isolated service containers; connections to internal services from containers that should not have network access to them.
• Configuration: Presence of container:<id> values in agents.defaults.sandbox.docker.network fields within gateway configuration files (GitHub Advisory).

Upgrade all OpenClaw instances to version 2026.2.24 or later, which blocks namespace-join style network modes (including container:) and enforces strict allowlisting for safe network modes (fixed in commit 14b6eea6e). As a compensating control prior to patching, audit all gateway configurations for any docker.network parameters containing container: values and remove or restrict them. Implement additional network segmentation and access controls to limit communication between container namespaces. Restrict access to the trusted operator configuration path to minimize the attack surface (GitHub Advisory).

The vulnerability was reported by researcher tdjackey and published by steipete via the GitHub Security Advisory program. The GitHub advisory initially rated the severity as Low, while external scoring by VulnCheck and ENISA assigned it a CVSS v4.0 score of 9.3 (Critical), reflecting a notable discrepancy in severity assessment between the vendor and external analysts. Limited broader community discussion has been observed on Mastodon and Bluesky (GitHub Advisory).