EUVD-2026-34009
GHSA-m4rx-8cqf-h494
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.
AnalysisAI
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with webhook endpoints without valid credentials, affecting all versions up to and including 3.11.3. The flaw resides in the resolveAuth function within internal/http/auth.go, where the authentication check can be bypassed entirely. A publicly available exploit has been disclosed (GitHub issue #1134), and the project acknowledges the issue as a bug; no confirmed patched release has been identified at time of analysis.
Technical ContextAI
GoClaw (CPE: cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*) is a Go-based application developed by nextlevelbuilder. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), which occurs when a function performing security-sensitive operations - in this case, webhook request verification - fails to enforce authentication before allowing access. The affected code path is the resolveAuth function in internal/http/auth.go, which serves as the Webhook Verification Handler. In webhook architectures, verification handlers are meant to authenticate incoming webhook calls (typically via secret tokens or HMAC signatures); a bypass here means external parties can send arbitrary webhook payloads without proving identity, potentially triggering backend logic meant only for trusted sources.
RemediationAI
No vendor-released patched version has been confirmed at time of analysis; the maintainer has tagged the report as a bug (GitHub issue #1134), but no fix release is identified in the available data. Monitor https://github.com/nextlevelbuilder/goclaw/issues/1134 and the repository's releases page for an upstream fix. As an immediate compensating control, restrict network access to the GoClaw webhook endpoint at the infrastructure layer (firewall rules, reverse proxy ACLs) to allow only trusted source IPs from known webhook originators - this eliminates the network-accessible attack surface without modifying application code. Alternatively, place the webhook handler behind an authenticating reverse proxy (e.g., nginx with HTTP basic auth or mTLS) to enforce credentials before requests reach the vulnerable resolveAuth function; note this may require webhook sender reconfiguration. If webhook functionality is not actively used, disable or remove the webhook handler route as a lower-risk option. Additional VulDB intelligence is available at https://vuldb.com/vuln/367926.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today