OpenClaw’s Docker sandbox accepts user‑supplied configuration without proper validation, allowing injection of dangerous Docker options such as bind mounts to system files or the Docker socket, host networking, and unconfined security profiles. This flaw enables an attacker to escape the intended sandbox boundary and gain direct access to the host filesystem or processes. The weakness falls under Insecure Configuration control, indexed as CWE‑250. The consequence is a compromise of the host system, potentially leading to full compromise of the underlying infrastructure where OpenClaw is running.

The affected product is OpenClaw, deployed in any environment prior to version 2026.2.15. All releases before this build are vulnerable to the described configuration injection issue.

OpenClaw has a CVSS score of 7.7, indicating a high severity level, yet its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting that exploitation is currently unlikely. The likely attack vector is the injection of malicious settings into the Docker sandbox configuration, either through a misconfigured configuration file or an exposed API that accepts such settings. Exploitation requires that the attacker can influence this configuration; it is not a purely remote network exploit. The risk remains high for systems that continue to run older snapshots of OpenClaw without mitigation.