EUVD-2026-45171
GHSA-28fj-c9jc-xpp3
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network vector aligns with CVSS 4.0 AV:A; no authentication or interaction required; low CIA impact scoped to the executor manager service only, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component.
AnalysisAI
Missing authentication on the executor_manager control-plane API in poco-ai/poco-claw through version 0.5.4 allows adjacent-network attackers to invoke the create_task endpoint without any credentials, enabling unauthorized task submission to the AI agent execution engine. The CVSS 4.0 vector (AV:A) confirms exploitation requires adjacency to the internal network segment hosting the executor manager service - it is not directly internet-exploitable. Public exploit code has been disclosed via GitHub issues #136/#137 and PR #135; no CISA KEV listing exists at time of analysis.
Technical ContextAI
poco-claw (CPE: cpe:2.3:a:poco-ai:poco-claw) is a microservices-based AI agent orchestration platform comprising a backend service, an executor manager (EM) control plane, and executor worker processes. The executor_manager exposes an HTTP API under executor_manager/app/api/v1/tasks.py; the create_task function in particular processes task scheduling without any token validation. CWE-306 (Missing Authentication for Critical Function) precisely describes the root cause: the EM API routes had no X-Internal-Token enforcement and no Bearer callback-token verification. The PR diff confirms the fix introduces X-Internal-Token header checks on EM control-plane routes and callback_token (Bearer) on executor proxy routes such as CallbackClient, UserInputClient, ComputerClient, MemoryClient, and ChannelRuntimeClient - establishing a token boundary that did not previously exist.
RemediationAI
Upgrade poco-claw to version 0.5.7, which contains fix commit 67fcc88505c57f77d3fcf04eb5b89425b10cbf48 (https://github.com/poco-ai/poco-claw/commit/67fcc88505c57f77d3fcf04eb5b89425b10cbf48) and is available at https://github.com/poco-ai/poco-claw/releases/tag/0.5.7. The patch enforces X-Internal-Token header validation on all EM control-plane routes and requires callback Bearer tokens on executor proxy paths. If immediate upgrade is not feasible, restrict network access to the executor_manager API port at the firewall or network policy layer - deny all traffic to the EM HTTP port from any host that is not the backend service itself. This compensating control is effective because the AV:A vector means physical or logical network adjacency is required; blocking the EM port at the network boundary fully prevents exploitation. Trade-off: this may break legitimate backend-to-EM communication if not scoped to a backend service allowlist.
Server-side request forgery in poco-ai/poco-claw up to version 0.5.4 allows remote unauthenticated attackers to coerce t
Unauthenticated authorization bypass in poco-ai/poco-claw's Workspace API allows remote attackers to access arbitrary us
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today