Is CVE-2026-32038 actively exploited?

No active exploitation of CVE-2026-32038 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32038 be exploited remotely?

Yes. CVE-2026-32038 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32038?

CVE-2026-32038 has a CVSS score of 9.0 (CRITICAL).

HOME VULNERABILITIESCVE-2026-32038

CRITICAL

CVE-2026-32038

CWE-284Published: March 19, 2026· Updated: Mar 23, 2026

9.0

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.4th

Official Description

OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id> values to reach services in target container namespaces and bypass network hardening controls.

NVD Source

Risk Analysis

This critical vulnerability in OpenClaw allows trusted operators to bypass network isolation and join another container's network namespace. With a CVSS score of 9.0, this flaw can lead to complete system compromise by allowing access to services in target container namespaces. The absence of an EPSS score means the likelihood of exploitation is not yet quantified, but the potential for bypassing critical security controls makes this a high-priority concern.

No public exploit is currently known for this vulnerability. Exploitation requires a trusted operator to configure the docker.network parameter with specific values, indicating a potentially internal threat or a compromised trusted account.

Recommended Action

Upgrade OpenClaw to version 2026.2.24 or later to address the sandbox network isolation bypass. Review and restrict the permissions of trusted operators and carefully validate docker.network parameter configurations.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-32038 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.