CVE-2026-32038 is a sandbox network isolation bypass in OpenClaw, scored 9.8 by NVD. The sandbox blocked host networking but accepted a setting that joins another container's network namespace. Upgrade OpenClaw to 2026.2.24 or later. The advisory sets a precondition worth reading, covered below.
What's affected
OpenClaw 2026.2.23 and earlier. The patched version is 2026.2.24.
The GitHub advisory states a precondition: the setting is a trusted operator configuration, for example the Docker network option in gateway config. It says this is not an unauthenticated remote exploit by itself, so the real severity depends on who can edit that configuration. VulnCheck rates it critical with a CVSS v4 score of 9.3.
How to check if you're exposed
OpenClaw is distributed on npm, so read the installed version.
npm ls openclaw
npm ls -g openclaw
OpenClaw release numbers are date based, so compare the version against the fixed release named above. If you run it in a container, check the image you deploy and rebuild it after updating.
What to do now
- Upgrade OpenClaw to 2026.2.24 or later.
- Review the sandbox Docker network setting in your gateway configuration and confirm it does not use a container namespace value.
- Limit who can edit gateway configuration, since the issue needs that access.
- Keep internal services that you would not expose to a sandbox off shared container networks.
Why it matters
The record lists CWE-284, improper access control. The hardening code rejected one dangerous value, host, and passed anything else to Docker. A value that joins an existing container's network namespace slipped through, which lets the sandbox reach services bound inside that container.
This is a common pattern: a blocklist of one bad value instead of an allowlist of good ones. The fix blocks namespace joining modes and keeps strict allowlisting.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Is this remotely exploitable by anyone?
The advisory says no. It requires access to the trusted sandbox network configuration.
Why does NVD say 9.8?
The NVD score assumes network attack conditions. The advisory's precondition lowers the practical risk for most setups.
Sources
Last reviewed: 19 October 2026.
