Skip to main content

GoClaw CVE-2026-15625

| EUVDEUVD-2026-43614 LOW
Incomplete List of Disallowed Inputs (CWE-184)
2026-07-14 VulDB GHSA-3qh8-qhwr-v2j5
Information Disclosure Goclaw
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network-accessible blacklist bypass requiring low-privilege auth; unchanged scope with limited C/I/A impact consistent with information-disclosure tag and CVSS 4.0 VC:L/VI:L/VA:L.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Jul 14, 2026 - 02:32 vuln.today
Severity Changed
Jul 14, 2026 - 02:22 NVD
MEDIUM LOW
CVSS changed
Jul 14, 2026 - 02:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
CVE Published
Jul 14, 2026 - 02:00 cve.org
LOW 2.1

DescriptionCVE.org

A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. Affected by this issue is the function ExecApprovalManager.CheckCommand of the file internal/tools/exec_approval.go. The manipulation results in incomplete blacklist. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

GoClaw 3.11.3 by nextlevelbuilder exposes an incomplete blacklist bypass in the ExecApprovalManager.CheckCommand function, allowing authenticated low-privilege remote attackers to circumvent command approval controls enforced in internal/tools/exec_approval.go. The bypass can yield limited confidentiality, integrity, and availability impacts consistent with the information-disclosure tag and the VC:L/VI:L/VA:L CVSS 4.0 impact metrics. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low-privilege GoClaw credentials
Delivery
Identify gap in ExecApprovalManager blacklist via public POC
Exploit
Craft command input bypassing CheckCommand filter
Execution
Submit crafted command over network
Impact
Access or modify restricted command-scoped data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires low-privilege authenticated access to the GoClaw application (confirmed by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not supported by available data). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 2.1 is unusually low for a network-accessible, low-complexity, low-privilege flaw, reflecting the constrained impact metrics (VC:L/VI:L/VA:L, no subsequent-system impact). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated user with low-privilege access to a GoClaw 3.11.3 deployment crafts a command input that falls outside the enumerated blacklist patterns in ExecApprovalManager.CheckCommand, submitting it over the network without requiring any victim interaction. The malformed or obfuscated command bypasses the approval filter, allowing the attacker to issue commands that should have been rejected, potentially reading restricted data or making unauthorized modifications within the scope GoClaw manages. …
Remediation No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Goclaw

View all
CVE-2026-10219 MEDIUM POC
5.5 Jun 01

OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
CVE-2026-10617 MEDIUM POC
5.5 Jun 02

Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
CVE-2026-7505 MEDIUM POC
5.5 Apr 30

Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
CVE-2026-15626 LOW POC
2.1 Jul 14

Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
CVE-2026-14716 LOW POC
2.1 Jul 05

Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
CVE-2026-15624 LOW POC
2.1 Jul 14

Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
CVE-2026-10218 LOW POC
2.1 Jun 01

Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker

CVE-2026-10217 LOW POC
2.1 Jun 01

Improper privilege management in nextlevelbuilder GoClaw up to version 3.11.3 allows authenticated low-privileged users

CVE-2026-10616 LOW POC
2.1 Jun 02

Missing authorization in nextlevelbuilder GoClaw up to version 3.11.3 allows low-privileged remote attackers to trigger

CVE-2026-15627 LOW POC
2.1 Jul 14

Information disclosure in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows remote low-privileged attackers to

CVE-2026-10583 LOW POC
2.0 Jun 02

Server-side request forgery in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers with high-privileg

Same weakness CWE-184 – Incomplete List of Disallowed Inputs

View all
CVE-2026-34415 CRITICAL POC
9.3
CVE-2026-41264 CRITICAL POC
9.2
CVE-2024-5217 CRITICAL POC
9.2
CVE-2023-2017 HIGH POC
8.8
CVE-2023-29003 HIGH POC
8.8
CVE-2021-25631 HIGH POC
8.8
CVE-2018-6383 HIGH POC
8.8
CVE-2015-5946 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-15625 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy