CVE-2026-32038: OpenClaw sandbox bypass enables

CISO Take

OpenClaw before 2026.2.24 allows any caller to join arbitrary Docker container network namespaces by setting the `docker.network` parameter to `container:<id>`, completely defeating the network isolation between AI agent workloads and adjacent services. With a CVSS of 9.8 — network-accessible, no authentication, no user interaction — and an EPSS placing it in the top 82% for exploitation likelihood, this is low-effort, high-reward for any attacker with network reach to an OpenClaw instance. The 396 CVEs already attributed to this package's history signal a systemic security posture problem that warrants escalation beyond this single patch. Patch to 2026.2.24 immediately, audit all configurations for `docker.network: container:*` values, and enforce explicit Docker network allowlists as a defense-in-depth measure.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Critical risk for organizations running OpenClaw in multi-container AI environments. The combination of network-accessible attack vector, zero authentication requirement, and complete CIA impact makes exploitation trivial. While no public exploit or CISA KEV listing exists yet, EPSS top-82% signals measurable near-term exploitation probability. Organizations with shared Docker hosts running AI services alongside OpenClaw face the highest blast radius — any co-located inference server, vector database, or internal API becomes reachable via namespace hijacking without any additional privilege escalation.

How does the attack unfold?

Initial Access

Attacker reaches OpenClaw's network-accessible configuration interface without credentials (AV:N, PR:N), either directly or via a malicious skill injected through the ClawHub ecosystem.

AML.T0049

Sandbox Escape

Attacker sets the `docker.network` parameter to `container:<target_id>`, causing OpenClaw to join the target container's Linux network namespace and bypass Docker's network segmentation controls.

AML.T0105

Lateral Movement

From within the target namespace, attacker accesses internal services bound to localhost or private Docker interfaces — including inference APIs, vector databases, and credential stores that assume network isolation as their primary defense.

AML.T0107

Impact

Attacker exfiltrates model weights, training data, API keys, or manipulates adjacent AI inference services, achieving full CIA compromise of co-located AI workloads with no additional escalation required.

AML.T0025

Initial Access

Attacker reaches OpenClaw's network-accessible configuration interface without credentials (AV:N, PR:N), either directly or via a malicious skill injected through the ClawHub ecosystem.

AML.T0049

Sandbox Escape

Attacker sets the `docker.network` parameter to `container:<target_id>`, causing OpenClaw to join the target container's Linux network namespace and bypass Docker's network segmentation controls.

AML.T0105

Lateral Movement

From within the target namespace, attacker accesses internal services bound to localhost or private Docker interfaces — including inference APIs, vector databases, and credential stores that assume network isolation as their primary defense.

AML.T0107

Impact

Attacker exfiltrates model weights, training data, API keys, or manipulates adjacent AI inference services, achieving full CIA compromise of co-located AI workloads with no additional escalation required.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.2.24 or later immediately.
Audit: Scan all Docker Compose files, Kubernetes manifests, and OpenClaw config files for docker.network: container:<id> values — treat any match as a potential indicator of misconfiguration or active exploitation.
Network isolation: Place AI services on separate user-defined Docker networks and enforce explicit inter-container communication allowlists at the daemon level.
Runtime hardening: Apply AppArmor or seccomp profiles that restrict network namespace syscalls for OpenClaw containers.
Detection: Monitor container process logs for network configuration changes referencing other container IDs, and alert on unexpected cross-container traffic from OpenClaw instances.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

A.6.2 - AI system security

NIST AI RMF

GOVERN 1.7 - Processes for AI Risk Containment

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32038?

OpenClaw before 2026.2.24 allows any caller to join arbitrary Docker container network namespaces by setting the `docker.network` parameter to `container:<id>`, completely defeating the network isolation between AI agent workloads and adjacent services. With a CVSS of 9.8 — network-accessible, no authentication, no user interaction — and an EPSS placing it in the top 82% for exploitation likelihood, this is low-effort, high-reward for any attacker with network reach to an OpenClaw instance. The 396 CVEs already attributed to this package's history signal a systemic security posture problem that warrants escalation beyond this single patch. Patch to 2026.2.24 immediately, audit all configurations for `docker.network: container:*` values, and enforce explicit Docker network allowlists as a defense-in-depth measure.

Is CVE-2026-32038 actively exploited?

No confirmed active exploitation of CVE-2026-32038 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32038?

1. Patch: Upgrade OpenClaw to 2026.2.24 or later immediately. 2. Audit: Scan all Docker Compose files, Kubernetes manifests, and OpenClaw config files for `docker.network: container:<id>` values — treat any match as a potential indicator of misconfiguration or active exploitation. 3. Network isolation: Place AI services on separate user-defined Docker networks and enforce explicit inter-container communication allowlists at the daemon level. 4. Runtime hardening: Apply AppArmor or seccomp profiles that restrict network namespace syscalls for OpenClaw containers. 5. Detection: Monitor container process logs for network configuration changes referencing other container IDs, and alert on unexpected cross-container traffic from OpenClaw instances.

What systems are affected by CVE-2026-32038?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Multi-container AI deployments, Model serving, RAG pipelines, Vector databases.

What is the CVSS score for CVE-2026-32038?

CVE-2026-32038 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMulti-container AI deploymentsModel servingRAG pipelinesVector databases

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id> values to reach services in target container namespaces and bypass network hardening controls.

Exploitation Scenario

An attacker with network access to an OpenClaw deployment — or control over a malicious skill installed via OpenClaw's plugin ecosystem (as observed in AIID #1368) — modifies the agent's `docker.network` parameter to `container:<target_id>`, where the target is an adjacent AI service such as a vLLM inference server or internal ChromaDB instance. OpenClaw joins the target container's network namespace, giving the attacker direct TCP access to all services bound to localhost or internal interfaces within that container. The attacker can then exfiltrate model weights, training data, or API credentials stored as environment variables, or manipulate the inference service directly — all without any additional privilege escalation or authentication.

Weaknesses (CWE)

CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.