EUVD-2026-45383
GHSA-g748-qfrv-53vm
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only vector and high privilege requirement carried directly from CVSS 4.0; unchanged scope and low CIA impact consistent with 4.0 subsequent-system metrics all rated N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/exec_approval.go. The manipulation results in incorrect authorization. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Incorrect authorization in GoClaw's execution approval module (versions up to 3.13.2) allows a high-privileged attacker on an adjacent network to bypass the binary execution allowlist enforced by the extractBin, RequestApproval, and matchesAllowlist functions. Despite the Authentication Bypass tag, exploitation is constrained to adjacent-network, high-privilege contexts per the CVSS 4.0 vector, limiting opportunistic abuse. A public proof-of-concept is available via the project's GitHub issue tracker, making exploitation accessible to any attacker who already meets the privilege and network prerequisites.
Technical ContextAI
GoClaw (CPE: cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*) is a Go-based tool by nextlevelbuilder that includes an execution approval subsystem designed to control which binaries may be run. The vulnerable logic lives in internal/tools/exec_approval.go across three interconnected functions: extractBin (parses the binary from a request), RequestApproval (handles the approval workflow), and matchesAllowlist (performs the authorization check against a permitted-binary list). CWE-863 (Incorrect Authorization) identifies the root cause as a failure to correctly enforce access control decisions - the allowlist check does not reliably distinguish permitted from prohibited binaries, allowing a crafted request to pass authorization when it should be denied. The adjacent attack vector (AV:A) indicates the service is exposed within a bounded network context rather than the open internet.
RemediationAI
No vendor-released patched version has been confirmed from the available references; the upstream fix appears to be tracked in the GitHub issue at https://github.com/nextlevelbuilder/goclaw/issues/1216 and its associated comment thread. Organizations should monitor that issue for a tagged release containing the fix. As a compensating control, restrict access to GoClaw's execution approval interface to only the minimum set of users who require it, reducing the pool of high-privileged accounts capable of triggering the flawed matchesAllowlist logic - the trade-off is increased operational friction for legitimate approvals. Additionally, enforce network-layer controls to limit adjacency by ensuring only known, trusted hosts can reach the GoClaw service, directly countering the AV:A attack vector. Enable and audit logging of all RequestApproval calls for anomalous binary approval patterns as a detection layer.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today