OpenClaw Sandbox Network Isolation Bypass Vulnerability

A sandbox network isolation bypass vulnerability has been identified in OpenClaw versions prior to 2026.2.24. This vulnerability allows trusted operators to join another container's network namespace, bypassing network hardening controls. By configuring the docker.network parameter with container:<id> values, operators can access services in target container namespaces.

Impact

Exploiting this vulnerability bypasses sandbox network isolation hardening, potentially allowing access to privileged or internal services in another container's network namespace.

Remediation

Users are advised to block namespace-join style network modes, including 'container:<id>', for sandbox containers and maintain strict allowlisting for safe network modes.