GoClaw EUVD-2026-33879

Exploitation requires the attacker to hold a high-privilege account within GoClaw - this is explicitly an authenticated attack (PR:H per CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U). The TTS Configuration Import feature at internal/http/tts_config.go must be accessible; if this endpoint is disabled, blocked at the network layer, or restricted to a further reduced role set, exploitation is prevented. The attack is network-reachable (AV:N) and requires no victim interaction beyond the attacker's own administrative session. What limits exploitation in practice: the high-privilege credential requirement is a meaningful barrier - this is not a guest, anonymous, or low-privilege user vulnerability. Additionally, the CVSS temporal metric RC:R (Reasonable, not Confirmed) indicates the vulnerability details have not yet been independently corroborated by the vendor. The absence of non-default configuration requirements means any GoClaw deployment on versions up to 3.11.3 with the TTS Configuration Import endpoint enabled is affected once admin credentials are obtained.

The CVSS 3.1 base score of 4.7 (Medium) reflects a genuine but constrained threat profile. The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), which are exploitability-positive factors. However, the high privilege requirement (PR:H) is the dominant risk-reduction signal: the attacker must already hold administrative or equivalent credentials within GoClaw, restricting the realistic attacker population to malicious insiders, compromised admin accounts, or attackers who have previously gained high-privilege access through another vector. The impact is limited across all three pillars (C:L/I:L/A:L) with unchanged scope (S:U), meaning the attacker cannot break out of the application's security boundary via this flaw alone. The temporal metric E:P elevates concern modestly - exploit code is publicly available, lowering the skill bar for authenticated attackers. No EPSS score was present in the source data, so probabilistic exploitation likelihood cannot be quantified. The remediation level RL:X indicates no confirmed patch at time of analysis. The project's characterization of this as a generic 'bug' may indicate delayed vendor response. Overall, this issue is a real priority for environments with internet-exposed GoClaw instances, weak admin credential hygiene, or insider threat concerns, but is lower urgency for well-controlled deployments.

An attacker with compromised administrative credentials for a GoClaw instance submits a crafted POST or import request to the TTS Configuration endpoint, supplying a URL pointing to the cloud instance metadata service (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) or an internal REST API endpoint not otherwise reachable from the internet. The GoClaw server fetches the attacker-supplied URL and returns or logs the response, enabling the attacker to harvest cloud IAM credentials, enumerate internal services, or pivot further into the backend network. A proof-of-concept demonstrating this technique is publicly available via GitHub issue #1132 in the nextlevelbuilder/goclaw repository.