CVE-2026-32038 — OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that…¶

Key facts

CVE-2026-32038 is a Critical (9.8) vulnerability: OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-32038
Severity	Critical (9.8)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32038/

Details¶

CVE-2026-32038 is a Critical (9.8) vulnerability: OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container: values to reach services in target container namespaces and bypass network hardening controls.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-32038
CVSS Score	9.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32038/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-32038

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/security/advisories/GHSA-ww6v-v748-x7g9
https://www.vulncheck.com/advisories/openclaw-sandbox-network-isolation-bypass-via-docker-network-container-parameter

Generated by PoC Generator on 2026-04-10T15:42:17.604799056

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-32038, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-32038 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-32038 OpenClaw sandbox network isolation bypass attempt"; content:"docker.network"; content:"container:"; distance:0; within:50; pcre:"/docker\.network.*container:[a-f0-9]{12,}/i"; classtype:policy-violation; sid:1000000; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32038 OpenClaw container namespace join via API"; content:"POST"; http_method; content:"/api"; http_uri; content:"docker.network"; http_client_body; content:"container:"; http_client_body; distance:0; within:100; classtype:policy-violation; sid:1000001; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32038 OpenClaw network parameter manipulation"; content:"network"; content:"namespace"; distance:0; within:30; content:"container:"; distance:0; within:50; pcre:"/container:[a-f0-9]{8,64}/i"; classtype:policy-violation; sid:1000002; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32038 OpenClaw JSON payload network bypass"; content:"{"; content:"docker.network"; distance:0; within:200; content:"container:"; distance:0; within:100; content:"}"; distance:0; within:50; classtype:policy-violation; sid:1000003; rev:1; priority:2;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32038_OpenClaw_Network_Bypass {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw sandbox network isolation bypass exploitation attempts"
        cve = "CVE-2026-32038"
        severity = "high"
        date = "2024"

    strings:
        $docker_network_param1 = "docker.network" ascii nocase
        $docker_network_param2 = "dockerNetwork" ascii nocase
        $container_id_pattern1 = /container:[a-fA-F0-9]{12,64}/ ascii
        $container_id_pattern2 = /container:[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}/ ascii
        $container_namespace1 = "container:" ascii
        $container_namespace2 = "--network=container:" ascii
        $openclaw_config1 = "openclaw" ascii nocase
        $openclaw_config2 = "OpenClaw" ascii
        $network_bypass1 = "network" ascii and "namespace" ascii
        $network_bypass2 = "net=container:" ascii
        $exploitation_pattern1 = /docker\.network\s*=\s*container:[a-fA-F0-9]+/ ascii nocase
        $exploitation_pattern2 = /dockerNetwork["\s]*[:=]["\s]*container:[a-fA-F0-9]+/ ascii nocase

    condition:
        (
            ($docker_network_param1 or $docker_network_param2) and
            ($container_id_pattern1 or $container_id_pattern2 or $container_namespace1 or $container_namespace2)
        ) or
        (
            ($openclaw_config1 or $openclaw_config2) and
            ($network_bypass1 or $network_bypass2)
        ) or
        ($exploitation_pattern1 or $exploitation_pattern2)
}

rule CVE_2026_32038_OpenClaw_Config_File {
    meta:
        author = "Security Engineer" 
        description = "Detects OpenClaw configuration files with network bypass parameters"
        cve = "CVE-2026-32038"
        severity = "medium"
        date = "2024"

    strings:
        $config_ext1 = ".yml" ascii
        $config_ext2 = ".yaml" ascii
        $config_ext3 = ".json" ascii
        $config_ext4 = ".conf" ascii
        $docker_network_config = /docker\.network\s*[:=]\s*["']?container:[a-fA-F0-9]+["']?/ ascii nocase
        $network_config_json = /"docker\.network"\s*:\s*"container:[a-fA-F0-9]+"/ ascii nocase
        $yaml_network_config = /docker\.network:\s*container:[a-fA-F0-9]+/ ascii nocase
        $openclaw_identifier1 = "openclaw" ascii nocase
        $openclaw_identifier2 = "version:" ascii and "2026" ascii

    condition:
        (
            ($config_ext1 or $config_ext2 or $config_ext3 or $config_ext4) and
            ($docker_network_config or $network_config_json or $yaml_network_config)
        ) and
        ($openclaw_identifier1 or $openclaw_identifier2)
}

rule CVE_2026_32038_OpenClaw_Memory_Artifacts {
    meta:
        author = "Security Engineer"
        description = "Detects in-memory artifacts of OpenClaw network bypass exploitation"
        cve = "CVE-2026-32038"
        severity = "high"
        date = "2024"

    strings:
        $hex_docker_net1 = { 64 6F 63 6B 65 72 2E 6E 65 74 77 6F 72 6B }
        $hex_container1 = { 63 6F 6E 74 61 69 6E 65 72 3A }
        $hex_openclaw1 = { 4F 70 65 6E 43 6C 61 77 }
        $hex_openclaw2 = { 6F 70 65 6E 63 6C 61 77 }
        $network_namespace1 = "joinNetworkNamespace" ascii
        $network_namespace2 = "setNetworkNamespace" ascii
        $container_exec1 = "docker exec" ascii
        $container_exec2 = "container_exec" ascii
        $bypass_indicator1 = "network_isolation_bypass" ascii
        $bypass_indicator2 = "sandbox_escape" ascii

    condition:
        (
            ($hex_docker_net1 and $hex_container1) or
            ($network_namespace1 or $network_namespace2)
        ) and
        ($hex_openclaw1 or $hex_openclaw2) and
        (
            $container_exec1 or $container_exec2 or 
            $bypass_indicator1 or $bypass_indicator2
        )
}

:material-file-download: prevention/yara.yar

# Block OpenClaw sandbox network isolation bypass attempts (CVE-2026-32038)
# Prevent docker.network parameter manipulation and container namespace access

# Block requests containing docker.network parameter with container: values
location ~* /.*$ {
    # Block docker.network parameter with container ID patterns
    if ($args ~* "docker\.network.*=.*container:") {
        return 403;
    }

    # Block JSON payloads containing docker network container references
    if ($request_body ~* "\"docker\.network\".*:.*\"container:") {
        return 403;
    }

    # Block URL-encoded docker network container parameters
    if ($args ~* "docker%2Enetwork.*container%3A") {
        return 403;
    }

    # Block various encoding attempts of docker.network container patterns
    if ($args ~* "(docker|DOCKER)(\.|%2E)(network|NETWORK).*container") {
        return 403;
    }
}

# Block specific API endpoints that could be exploited
location ~* ^/(api/v[0-9]+/)?(containers?|docker|network|namespace)/ {
    # Block container network configuration attempts
    if ($request_method = "POST|PUT|PATCH") {
        if ($request_body ~* "network.*container:|namespace.*join") {
            return 403;
        }
    }

    # Block container ID patterns in network parameters
    if ($args ~* "network.*[a-f0-9]{12,64}") {
        return 403;
    }
}

# Block configuration endpoints that accept network parameters
location ~* ^/(config|settings|admin)/ {
    # Block docker network container configuration
    if ($request_body ~* "\"network\".*\"container:[a-f0-9]") {
        return 403;
    }

    # Block network namespace manipulation attempts
    if ($request_body ~* "namespace.*join|network.*attach") {
        return 403;
    }
}

# Add security headers to prevent bypass attempts
location / {
    # Prevent content type confusion
    add_header X-Content-Type-Options nosniff;

    # Prevent clickjacking
    add_header X-Frame-Options DENY;

    # Enable XSS protection
    add_header X-XSS-Protection "1; mode=block";

    # Block container network parameter patterns in headers
    if ($http_user_agent ~* "docker|container|network") {
        if ($args ~* "container:|namespace") {
            return 403;
        }
    }
}

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-32038 - OpenClaw sandbox network isolation bypass
# Protects against container network namespace manipulation attacks

# Rule 1000000: Block attempts to set docker.network parameter with container: prefix
SecRule ARGS "@rx (?i)docker\.network.*container:" \
    "id:1000000,\
    phase:2,\
    block,\
    msg:'CVE-2026-32038: Attempted docker.network container namespace manipulation',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-injection',\
    tag:'cve-2026-32038',\
    tag:'container-escape'"

# Rule 1000001: Block JSON payloads containing docker.network with container references
SecRule REQUEST_BODY "@rx (?i)[\"']docker\.network[\"']\s*:\s*[\"']container:" \
    "id:1000001,\
    phase:2,\
    block,\
    msg:'CVE-2026-32038: JSON payload contains docker.network container reference',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-injection',\
    tag:'cve-2026-32038',\
    tag:'container-escape'"

# Rule 1000002: Block URL-encoded docker.network container parameters
SecRule ARGS "@rx (?i)docker%2enetwork.*container%3a" \
    "id:1000002,\
    phase:2,\
    block,\
    msg:'CVE-2026-32038: URL-encoded docker.network container parameter detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-injection',\
    tag:'cve-2026-32038',\
    tag:'container-escape'"

# Rule 1000003: Block network namespace manipulation in request headers
SecRule REQUEST_HEADERS "@rx (?i)docker\.network.*container:" \
    "id:1000003,\
    phase:1,\
    block,\
    msg:'CVE-2026-32038: Docker network container reference in request headers',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-injection',\
    tag:'cve-2026-32038',\
    tag:'container-escape'"

# Rule 1000004: Block attempts with hexadecimal container IDs pattern
SecRule ARGS "@rx (?i)docker\.network.*container:[a-f0-9]{12,64}" \
    "id:1000004,\
    phase:2,\
    block,\
    msg:'CVE-2026-32038: Docker network container ID pattern detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-injection',\
    tag:'cve-2026-32038',\
    tag:'container-escape'"

# Rule 1000005: Block network configuration APIs with suspicious patterns
SecRule REQUEST_URI "@rx (?i)/(api/|v[0-9]+/)?.*network.*config" \
    "id:1000005,\
    phase:1,\
    chain,\
    msg:'CVE-2026-32038: Network configuration API access with container reference',\
    logdata:'URI: %{REQUEST_URI}',\
    severity:'HIGH',\
    tag:'attack-injection',\
    tag:'cve-2026-32038'"
    SecRule REQUEST_BODY "@rx (?i)container:" \
        "setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-32038?¶

CVE-2026-32038 is a Critical (9.8) vulnerability: OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32038?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32038?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.