Docker container escape via unvalidated bind mount injection in OpenClaw
A configuration injection vulnerability in OpenClaw's Docker sandbox could allow container escape or host data access if dangerous Docker options were applied via unvalidated configuration. The issue was patched in version 2026.2.15 with runtime enforcement and schema validation.
What happened
A configuration injection issue in OpenClaw's Docker tool sandbox allowed dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied if an attacker or operator influenced the sandbox Docker configuration.
Affected versions were OpenClaw npm package versions up to and including 2026.2.14. The vulnerability could allow mounting of sensitive host paths such as /etc, /proc, /sys, /dev, or the Docker socket, use of network=host to bypass container network isolation, or use of unconfined seccomp or AppArmor profiles to weaken isolation.
Reported impact
This could lead to host secret exfiltration or full host control via Docker socket exposure.
OpenClaw released version 2026.2.15 with fixes that block dangerous sandbox Docker settings through runtime enforcement and config-schema validation.
Index analysis
The vulnerability involved unvalidated configuration that could permit container escape or unauthorized access to host system resources and secrets.
Governance controls
OpenClaw implemented runtime enforcement when building Docker create arguments and added config-schema validation for network=host, seccompProfile=unconfined, and apparmorProfile=unconfined settings.
The fix included security audit findings to surface dangerous sandbox Docker configuration.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.