GoClaw CVE-2026-10218

Exploitation requires a valid low-privileged account on the target GoClaw instance (PR:L per CVSS vector) - unauthenticated exploitation is not supported by available data. The attacker must have network access to the GoClaw HTTP service. The vulnerability is specific to the auth function in internal/http/evolution_handlers.go, meaning the evolution handler endpoints must be accessible and reachable. No special non-default configuration is indicated as required beyond the presence of the vulnerable code path. Exploitation is limited by: (1) mandatory possession of at least a low-privilege credential, (2) no confidentiality impact - an attacker cannot exfiltrate data via this vector, and (3) impact is bounded to low integrity and availability on the vulnerable component only with no lateral scope change.

The CVSS 4.0 base score of 2.1 is very low. The vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable exploitation with low complexity and no attack prerequisites, but PR:L confirms that a low-privileged account is required - unauthenticated exploitation is not supported by this vector. Impact is limited to low integrity (VI:L) and low availability (VA:L) on the vulnerable system, with no confidentiality impact and no scope change to subsequent systems. The exploit maturity modifier E:P confirms a proof-of-concept exists publicly. There is no EPSS data provided and no CISA KEV listing, indicating no confirmed widespread or targeted exploitation at time of analysis. Despite public POC availability, the constrained impact scope (no data exposure, no remote code execution) and authentication requirement substantially reduce real-world priority for most environments. This is a low-severity, publicly-known authorization flaw - not a critical priority unless GoClaw is exposed to untrusted low-privileged users.

An attacker who holds a low-privileged account on a GoClaw deployment sends a crafted HTTP request targeting the auth-gated evolution endpoints, exploiting the improper authorization logic to perform actions beyond their assigned permission level - such as triggering unintended state changes or degrading service availability. A public proof-of-concept is available via GitHub issue #1120, lowering the bar for exploitation by less sophisticated actors. Given the low impact scope (VI:L/VA:L), a realistic outcome is limited data manipulation or minor service disruption rather than full system compromise.