N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-w7j5-j98m-w679

GHSA-w7j5-j98m-w679: OpenClaw has multiple E2E/test Dockerfiles that run all processes as root

Three Dockerfiles in scripts/docker/ and scripts/e2e/ lack a USER directive, meaning all processes run as uid 0 (root). If any process is compromised, the attacker has root inside the container, making container breakout significantly easier. Partial fix (2026-02-08): Commit 28e1a65e added USER sandbox to Dockerfile.sandbox and Dockerfile.sandbox-browser. The E2E/test Dockerfiles listed below remain unpatched.

Affected components:

scripts/e2e/Dockerfile
scripts/e2e/Dockerfile.qr-import
scripts/docker/install-sh-e2e/Dockerfile
scripts/docker/install-sh-nonroot/Dockerfile (runs as app but with NOPASSWD sudo — see related advisory)

Technical Reproduction:

Open each Dockerfile listed above and search for a USER directive — none found.
Run any of these containers: docker run --rm -it <image> id
Observe: returns uid=0(root).

Demonstrated Impact:

Root inside the container enables kernel exploit attempts, volume mount abuse, and privileged syscall access.
Test images share the same base (node:22-bookworm) as production, creating risk of accidental deployment of root-running images.

Environment: Base images node:22-bookworm and node:22-bookworm-slim default to root. Dockerfile.sandbox and Dockerfile.sandbox-browser were remediated in commit 28e1a65e; only the E2E/test images listed above remain affected.

Remediation: Add a USER directive before CMD/ENTRYPOINT in each remaining Dockerfile: RUN useradd --create-home --shell /bin/bash appuser USER appuser

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-w7j5-j98m-w679

GHSA-w7j5-j98m-w679:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.21	2026.2.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in multiple Dockerfiles within the openclaw/openclaw repository that lack a USER directive. This results in containers where all processes are executed with root privileges (uid 0). If any process within such a container is compromised, an attacker gains full root access, significantly increasing the risk of container breakout and further system compromise.

A partial fix was applied in commit 28e1a65ebc580f07533966f5693f4df0a18d7085, which added a non-root user to Dockerfile.sandbox and Dockerfile.sandbox-browser. However, the security advisory GHSA-w7j5-j98m-w679 indicates that several other E2E and test Dockerfiles remained vulnerable at the time.

The identified "vulnerable functions" are the default commands or entrypoint scripts specified in these Dockerfiles, as they would be the processes running as root. For example, in Dockerfile.sandbox, the sleep command would run as root. While the repository's main branch appears to have patched the other files since the advisory was published, the vulnerability existed in versions prior to the patches. The analysis identifies the processes that would have been running as root in the vulnerable versions, based on the provided commit and the advisory.

Vulnerable functions

sleep

Dockerfile.sandbox

The Dockerfile was missing a `USER` directive, causing the `CMD` ["sleep", "infinity"] to be executed as the root user. An attacker compromising the container would have root privileges.

openclaw-sandbox-browser

Dockerfile.sandbox-browser

The Dockerfile was missing a `USER` directive, causing the `CMD` ["openclaw-sandbox-browser"] to be executed as the root user. An attacker compromising the container would have root privileges.

bash

scripts/e2e/Dockerfile

According to the advisory, this Dockerfile was missing a `USER` directive, causing the `CMD` ["bash"] to be executed as the root user. The file content fetched appears to be from a patched version, but vulnerable versions lacked the `USER` directive.

node

scripts/e2e/Dockerfile.qr-import

According to the advisory, this Dockerfile was missing a `USER` directive. The base image's default command (`node`) would therefore run as root. The file content fetched appears to be from a patched version, but vulnerable versions lacked the `USER` directive.

/usr/local/bin/openclaw-install-e2e

scripts/docker/install-sh-e2e/Dockerfile

According to the advisory, this Dockerfile was missing a `USER` directive, causing the `ENTRYPOINT` script `/usr/local/bin/openclaw-install-e2e` to be executed as the root user. The file content fetched appears to be from a patched version, but vulnerable versions lacked the `USER` directive.

/usr/local/bin/openclaw-install-nonroot

scripts/docker/install-sh-nonroot/Dockerfile

The advisory notes that this Dockerfile runs as a non-root user but with `NOPASSWD sudo` privileges, which is a privilege escalation risk. The `ENTRYPOINT` script `/usr/local/bin/openclaw-install-nonroot` runs as this user. This is a related but distinct issue from running directly as root.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.