GoClaw EUVD-2026-34009

The Webhook Verification Handler must be enabled and reachable - specifically, the resolveAuth function in internal/http/auth.go must be in the request processing path for webhook endpoints. No special non-default configuration is required beyond GoClaw being deployed with its webhook functionality active, which is a standard feature of the application. The CVSS 4.0 vector (PR:N/UI:N) confirms unauthenticated exploitation with no user interaction needed. Exploitation is limited by: the attacker needing network access to the webhook HTTP endpoint (mitigated by firewall rules); the impact scope being confined to the webhook handler context rather than the broader application; and the vulnerability affecting only GoClaw versions up to 3.11.3. Deployments where the webhook handler is internal-only or IP-restricted face meaningfully lower real-world risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-accessible exploitation with low complexity, no attack prerequisites, no privileges required, and no user interaction - placing this in the easiest possible exploitation category. However, the impact scores are uniformly low (VC:L/VI:L/VA:L) with no subsequent system scope impact (SC:N/SI:N/SA:N), yielding a moderate overall score of 5.5. The exploit maturity modifier (E:P) confirms a proof-of-concept exists, which elevates practical risk above what the score alone suggests. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. EPSS data was not provided in the available intelligence. The real-world risk profile is: trivial to exploit with public PoC, but impact is constrained to the webhook handler's data plane - unauthorized reads, limited writes, or minor disruption - rather than full system compromise. This is a genuine remediation priority for any internet-facing GoClaw deployment, but not a critical emergency absent evidence of active targeting.

An external attacker identifies a GoClaw instance with its webhook endpoint exposed to the network (or internet), sends a crafted HTTP request directly to the webhook verification handler, and bypasses the resolveAuth authentication check due to the CWE-306 flaw - gaining the ability to submit unauthenticated webhook payloads that trigger backend processing logic. A proof-of-concept demonstrating this bypass has been publicly disclosed via GitHub issue #1134, lowering the skill bar required to attempt exploitation. The low-complexity, zero-privilege CVSS vector confirms this is reproducible without specialized tooling.