EUVD-2026-45382
GHSA-952r-63wr-g75f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote exploitation requires low-privilege credentials; limited and balanced C/I/A impact; no scope change as bypass remains within GoClaw's own authorization boundary.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
AnalysisAI
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attackers to bypass binary execution controls by manipulating the isSafeBin function in internal/tools/exec_approval.go. The authorization logic flaw permits approval of binaries that should be restricted, with potential for unauthorized code execution within the tool's operational context - particularly impactful in pipeline or build automation deployments. A publicly available proof-of-concept exists (CVSS 4.0 E:P); the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.
Technical ContextAI
GoClaw is a Go-based tool by nextlevelbuilder (CPE: cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*) that includes an exec approval mechanism for governing binary execution. The isSafeBin function in internal/tools/exec_approval.go is responsible for determining whether a binary is authorized to execute - a classic allowlist or authorization gate. CWE-285 (Improper Authorization) indicates the function fails to correctly enforce its access control policy, likely through incomplete allowlist validation, bypassable path/name normalization, or insufficient caller permission verification. In build automation or CI/CD contexts, such a control gate is a trust boundary; a bypass could allow unauthorized binaries to enter a trusted execution pipeline.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - the patch status should be treated as 'upstream fix pending' based on GitHub issue tracking only (https://github.com/nextlevelbuilder/goclaw/issues/1214, https://github.com/nextlevelbuilder/goclaw/issues/1206). Monitor the project repository at https://github.com/nextlevelbuilder/goclaw/ for a tagged release addressing this flaw and upgrade immediately upon availability. As compensating controls until a patch is confirmed: restrict access to GoClaw's exec approval endpoint to the minimum required set of authenticated accounts (the PR:L requirement means credential restriction directly limits the attack surface); enforce network-level access controls to prevent unauthorized hosts from reaching the service; and implement audit logging for all isSafeBin authorization decisions to detect anomalous approvals. These controls reduce exposure but do not eliminate the underlying authorization flaw.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today