EUVD-2026-45410
GHSA-gch8-7366-6m32
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low complexity; PR:L because a valid account is required; no scope change; all impacts limited per CVSS 4.0 source data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed_exec.go. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used.
AnalysisAI
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to bypass access controls via manipulation of the ExecTool.Execute function in credentialed_exec.go. The CVSS 4.0 vector confirms network-accessible exploitation requiring only low-privilege credentials, with limited but confirmed confidentiality, integrity, and availability impact on the vulnerable system. A publicly available proof-of-concept exploit exists (tracked in GitHub issue #1215), though the overall CVSS 4.0 base score of 2.1 reflects constrained real-world impact.
Technical ContextAI
GoClaw is a Go-based tool developed by nextlevelbuilder. The vulnerability resides in goclaw/internal/tools/credentialed_exec.go within the ExecTool.Execute function, which is responsible for credentialed command or tool execution. CWE-285 (Improper Authorization) identifies the root cause: the function fails to adequately verify that the requesting principal has sufficient permissions for the requested operation, allowing a lower-privileged caller to invoke execution paths intended for higher-privilege roles. The file name 'credentialed_exec' strongly implies this component is a trust boundary - it should enforce authorization before executing privileged operations, but the check is either absent, incomplete, or bypassable. The affected CPE is cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*, covering all versions through 3.13.3-beta.3.
RemediationAI
Upstream fix activity is visible in GitHub issue #1215 (https://github.com/nextlevelbuilder/goclaw/issues/1215) and associated comment thread; however, a tagged patched release version has not been confirmed from the available data, so operators should monitor the repository directly for a corrective release. As a compensating control, restrict access to the GoClaw service to only fully trusted, higher-privileged identities by enforcing authentication at the network or application gateway layer, preventing low-privileged accounts from reaching the ExecTool.Execute endpoint. Additionally, audit existing low-privilege users who have network access to the GoClaw instance and remove unnecessary accounts. If GoClaw is not required in production, consider disabling the service until a verified patch is available. Each of these controls reduces the PR:L attack surface but does not eliminate the underlying authorization flaw.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today