Summary

The Docker build flow writes sensitive runtime values to a repo-root .env file and then builds from the same root using COPY . .. Because .dockerignore does not exclude .env, gateway tokens and other secrets can be embedded in image layers and extracted by anyone with image access.

CVSS Assessment

CVSS v3.1 Calculator

Affected Code

File: docker-setup.sh:125

ENV_FILE="$ROOT_DIR/.env"
# ...
upsert_env "$ENV_FILE" \
  OPENCLAW_GATEWAY_TOKEN \
  OPENCLAW_IMAGE \
  OPENCLAW_EXTRA_MOUNTS

docker build \
  -t "$IMAGE_NAME" \
  -f "$ROOT_DIR/Dockerfile" \
  "$ROOT_DIR"

File: Dockerfile:26

COPY . .

File: .dockerignore

.git
.worktrees
.bun-cache
.bun
.tmp
# ... no .env or .env.* ignore rule present

Attack Surface

• Entry point: Pulling or receiving a built image artifact that was produced from a workspace containing .env
• Authentication: None (unauthenticated/public access to published images)
• Complexity: Low (no special conditions)
• User interaction: None

Steps to Reproduce

1. Run the Docker setup flow that writes .env and builds the image from repo root.
2. Export or run the built image.
3. Inspect image contents (docker run --rm <image> cat /app/.env) and observe secret values.

Impact

Recommended Fix

Add .env and .env.* to .dockerignore immediately and avoid COPY . . for production builds. Move runtime secret generation outside the Docker build context and pass secrets only at container runtime.

References

• CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Exploit Conditions

Complexity:

• Low (no special conditions, works reliably)
• High (requires race condition, specific config, or timing)

User interaction:

• None (automatic, no victim action needed)
• Required (victim must click, visit, or perform action)

Prerequisites: Build performed with secrets present in repo-root .env, and image is shared, pushed to a registry, or otherwise retrievable.