GoClaw EUVD-2026-41730

Exploitation requires a valid low-privilege authenticated session against the GoClaw WebSocket RPC interface (PR:L per CVSS 4.0 vector - unauthenticated exploitation is not indicated). The attacker must have network access to the WebSocket endpoint served by the GoClaw gateway. The vulnerability is specific to the MethodRouter.Handle function in internal/gateway/router.go; only deployments running GoClaw up to 3.13.0-beta.2 with the WebSocket RPC Handler active are affected. Exploitation is limited by the requirement to first obtain any valid credential - anonymous or fully unauthenticated exploitation is not supported by the available data. No specific non-default configuration trigger is mentioned in the description, suggesting any standard deployment with the WebSocket handler enabled is vulnerable once credentials are obtained.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-exploitable with low complexity, no special attack requirements, but requiring low-privilege authentication - this is a meaningful constraint that limits the attack surface to users who can obtain any valid credential. Impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), consistent with partial method-level access bypass rather than full compromise. No EPSS data was supplied; however, the E:P (PoC Exists) supplemental metric confirms a public exploit is available, which materially increases exploitation likelihood for targeted attacks. The vulnerability is not in CISA KEV, so no confirmed active exploitation. The overall risk is moderate in context: an insider or credential-holding attacker with network access to the WebSocket endpoint can exceed their authorized scope. For a beta-stage, niche product, the real-world exposure is likely limited but non-trivial for deployments in production. No conflicting signals between CVSS and description.

An attacker who holds any low-privilege account on a GoClaw deployment connects to the exposed WebSocket RPC endpoint and sends a crafted RPC call targeting a method they are not authorized to invoke. Because MethodRouter.Handle incorrectly evaluates authorization for the request, the method executes with the attacker's session, potentially exposing restricted data or performing unauthorized mutations. A public proof-of-concept is available, meaning this scenario requires minimal technical sophistication beyond credential acquisition.