GoClaw CVE-2026-16119

Exploitation requires a valid low-privileged account on the GoClaw instance (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not supported. The WebSocket Approval Endpoint must be network-reachable; if the application is deployed with the endpoint behind authentication middleware that blocks all external connections, remote exploitation is prevented. The affected function is RequestApproval in internal/tools/exec_approval.go, so only instances where this approval workflow component is active and reachable are vulnerable. Exploitation is limited by the Low impact ratings across C/I/A - the bypass enables unauthorized approval actions rather than arbitrary code execution or full data exfiltration. No non-default configuration is stated as required; any GoClaw deployment up to 3.13.2 with a reachable WebSocket endpoint and accessible low-privileged accounts is at risk.

The CVSS 4.0 base score of 5.3 (Medium) reflects a constrained but real-world exploitable flaw: AV:N confirms remote reachability, AC:L and AT:N indicate no special timing or environmental conditions, and PR:L confirms a low-privileged account is sufficient. Confidentiality, integrity, and availability impacts are each rated Low, suggesting the authorization bypass enables actions that are bounded in scope rather than full system compromise. The E:P supplemental metric confirms a public exploit exists, elevating urgency above the raw score suggests. There is no CISA KEV listing, meaning confirmed mass exploitation has not been observed; however, the combination of public PoC and a straightforward low-complexity attack vector makes opportunistic abuse feasible. No EPSS score was provided, so probabilistic exploitation likelihood is unconfirmed. The product's niche footprint limits blast radius at scale, but any deployment running GoClaw 3.13.2 or earlier with the WebSocket endpoint exposed should treat this as an active risk given the public exploit.

An attacker with a valid low-privileged GoClaw account connects to the WebSocket Approval Endpoint and sends a crafted RequestApproval message referencing an approval action they are not authorized to perform. Because the authorization check in exec_approval.go does not correctly validate the caller's privilege level, the server processes the approval as if it came from an authorized approver. A public proof-of-concept demonstrating this bypass is available via the GitHub issue tracker.