EUVD-2026-41730
GHSA-46qv-77xg-7vj5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low complexity; PR:L because low-privilege authentication is required; limited partial impact across C/I/A with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of the component WebSocket RPC Handler. Such manipulation leads to incorrect authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report.
AnalysisAI
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote attackers to bypass access controls on restricted methods. Affects all versions up to and including 3.13.0-beta.2. No public exploit identified as actively exploited (not in CISA KEV), but a publicly available proof-of-concept exists, lowering the barrier for exploitation against any exposed GoClaw deployment.
Technical ContextAI
GoClaw (CPE: cpe:2.3:a:nextlevelbuilder:goclaw) is a gateway-layer application likely serving as an API or RPC gateway, given the affected component is a WebSocket RPC Handler. The vulnerable code resides in internal/gateway/router.go within the MethodRouter.Handle function, which is responsible for routing and enforcing authorization on incoming WebSocket RPC calls. CWE-863 (Incorrect Authorization) indicates the system performs authentication but fails to correctly validate whether the authenticated principal is permitted to invoke specific methods - a logic flaw rather than a missing check entirely. This is consistent with the 'Authentication Bypass' tag, suggesting a low-privilege session can invoke methods intended for higher-privilege roles by exploiting flawed route-level authorization decisions.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - the fix is tracked via GitHub issue #1188 (https://github.com/nextlevelbuilder/goclaw/issues/1188) and no tagged release has been identified as containing the fix. Monitor the repository for a patched release beyond 3.13.0-beta.2. As an interim compensating control, restrict network access to the WebSocket RPC endpoint using firewall rules or reverse-proxy ACLs, ensuring only trusted, explicitly authorized users can establish WebSocket sessions - trade-off is reduced accessibility for legitimate clients. Additionally, audit the MethodRouter.Handle logic in internal/gateway/router.go directly and apply manual authorization checks per method if operating this software in production. Avoid exposing the WebSocket RPC interface to untrusted networks until a patched version is available. Refer to VulDB advisory at https://vuldb.com/vuln/376305 for updates.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today