PT-2026-20964 · Openclaw+1 · Openclaw+1

Aether-Ai-Agent · Published 2026-02-18 · Updated 2026-02-25 · CVE-2026-27002

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.15

Description A configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, potentially enabling container escape or host data access. The affected versions lack restrictions on dangerous sandbox Docker settings and runtime enforcement during the construction of docker create arguments. Config-schema validation is absent for network=host, seccompProfile=unconfined, and apparmorProfile=unconfined.

Recommendations Do not configure agents.*.sandbox.docker.binds to mount system directories or Docker socket paths. Keep agents.*.sandbox.docker.network at none (default) or bridge. Do not use unconfined for seccomp/AppArmor profiles.

Exploit

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2026-27002

GHSA-W235-X559-36MG

Affected Products

Docker

Openclaw

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27002.json · Exploit
• https://github.com/openclaw/openclaw/commit/887b209db47f1f9322fead241a1c0b043fd38339 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-w235-x559-36mg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27002 · Security Note
• https://osv.dev/vulnerability/GHSA-w235-x559-36mg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27002 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.15 · Note
• https://twitter.com/AIengineerlife/status/2026313197599519177 · Twitter Post
• https://twitter.com/cracbot/status/2026613195608301841 · Twitter Post
• https://twitter.com/TheHackerWire/status/2024916117874217276 · Twitter Post
• https://twitter.com/CVEarity/status/2024797736785322055 · Twitter Post