EUVD-2026-45384
GHSA-64vj-9h4v-597g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with low-privilege auth required; missing authorization yields limited CIA impact with no scope change to other systems.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file internal/http/tools_invoke.go of the component Invoke Endpoint. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remote attackers to invoke tool functionality without proper permission checks. The flaw resides in the ToolsInvokeHandler.ServeHTTP function within internal/http/tools_invoke.go, where authorization is absent rather than bypassed cryptographically. A public proof-of-concept exploit is available via GitHub, lowering the bar for exploitation; however, this CVE is not currently listed in the CISA KEV catalog, so confirmed active exploitation has not been established at time of analysis.
Technical ContextAI
GoClaw is a Go-based application developed by nextlevelbuilder, identified by CPE cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*. The vulnerable code path is the HTTP handler ToolsInvokeHandler.ServeHTTP in internal/http/tools_invoke.go, which exposes a tool invocation endpoint over HTTP. The root cause class is CWE-862 (Missing Authorization): the handler performs operations upon receiving a request without verifying that the authenticated caller holds the necessary permissions to use the Invoke Endpoint. This is distinct from an authentication bypass - the caller is authenticated (PR:L in the CVSS vector), but no authorization gate exists to scope what that caller may invoke. In Go HTTP servers, this typically manifests as a missing middleware check or absent permission validation before dispatching handler logic.
RemediationAI
No vendor-released patched version has been independently confirmed in the available data. The vulnerability was disclosed via GitHub issue tracker at https://github.com/nextlevelbuilder/goclaw/issues/1217 - monitor that issue and the repository at https://github.com/nextlevelbuilder/goclaw/ for a fix release. Until a patch is available, restrict network access to the Invoke Endpoint at the reverse proxy or firewall layer, allowing only known trusted internal IP ranges to reach it; this reduces exposure without requiring application changes but does not fix the underlying authorization gap. Additionally, enforce the principle of least privilege by auditing which accounts hold any level of access to the GoClaw instance, revoking unnecessary ones to shrink the pool of potential abusers. Full VulDB intelligence is available at https://vuldb.com/cve/CVE-2026-16123.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today