---
id: CVE-2026-32038
title: >-
  OpenClaw - Sandbox Network Isolation Bypass via docker.network=container
  Parameter
summary: >-
  OpenClaw before 2026.2.24 contains a sandbox network isolation bypass
  vulnerability that allows trusted operators to join another container's
  network namespace. Attackers can configure the docker.network parameter with
  container:<id> val…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-284
vendor: OpenClaw
product: OpenClaw
affected:
  - OpenClaw < 2026.2.24
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-03-20T20:09:00.505022Z'
published: '2026-03-19'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:01:56.061Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-32038'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-ww6v-v748-x7g9
    label: GitHub Security Advisory (GHSA-ww6v-v748-x7g9)
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-sandbox-network-isolation-bypass-via-docker-network-container-parameter
    label: >-
      VulnCheck Advisory: OpenClaw - Sandbox Network Isolation Bypass via
      docker.network=container Parameter
tags:
  - cve.org
epss: 0.00276
epssPercentile: 0.20128
ingestedAt: '2026-11-08T14:51:22.458Z'
---

## Overview

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id> values to reach services in target container namespaces and bypass network hardening controls.

## Affected

- `OpenClaw < 2026.2.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.