Root Process Vulnerability in OpenClaw Package: Multiple Dockerfiles Running as Root
Summary
GHSA-w7j5-j98m-w679: OpenClaw has multiple E2E/test Dockerfiles that run all processes as root. Affects openclaw versions < 2026.2.21. Fixed in 2026.2.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source project designed for managing and executing end-to-end tests within a Docker environment. It utilizes Docker containers to streamline testing processes, ensuring that applications behave as expected. However, certain Dockerfiles within OpenClaw have been identified to run all processes as the root user, which poses significant security risks.
Vulnerability Detail
The vulnerability arises from three Dockerfiles located in the scripts/docker/ and scripts/e2e/ directories that lack a USER directive. This omission means that all processes within these containers execute with UID 0 (root). If any process is compromised, an attacker gains root access inside the container, making it easier to perform container breakout attacks. The affected Dockerfiles are scripts/e2e/Dockerfile, scripts/e2e/Dockerfile.qr-import, scripts/docker/install-sh-e2e/Dockerfile, and scripts/docker/install-sh-nonroot/Dockerfile. The potential ramifications include kernel exploit attempts, volume mount abuse, and privileged syscall access, which could lead to severe security breaches.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.21
This is the first release that contains the fix.
npm install openclaw@2026.2.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can run the affected containers with reduced privileges by specifying the user when executing the docker run command. For example:
docker run --rm -it --user appuser <image>
Conclusion
The OpenClaw package has a critical vulnerability due to multiple Dockerfiles running processes as root, which can lead to severe security risks. It is essential to update to the patched version and implement the suggested fixes to mitigate these risks effectively.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability has a CVSS score of 8.4, indicating a high level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Running processes as root in Docker containers increases the risk of container breakout, allowing attackers to exploit vulnerabilities and gain unauthorized access to the host system.
Yes, a patch is available in version 2026.2.21 of the OpenClaw package. It is recommended to update to this version or later.
If immediate updates are not possible, consider implementing the provided workaround to run the containers with reduced privileges.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
