EUVD-2026-43599
GHSA-qwq3-fp3r-94hc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access with no complexity barriers; impact limited to low confidentiality read of workspace files, no integrity or availability impact, scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument user_id can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. Upgrading the affected component is recommended.
AnalysisAI
Unauthenticated authorization bypass in poco-ai/poco-claw's Workspace API allows remote attackers to access arbitrary users' workspace files by manipulating the user_id parameter in the get_workspace_file function. All versions through 0.5.4 are affected, with the executor manager's control-plane routes completely lacking token-based authentication before the fix. Publicly available exploit code exists (POC confirmed via GitHub issue #133 and PR #135); no CISA KEV listing at time of analysis.
Technical ContextAI
poco-claw (CPE: cpe:2.3:a:poco-ai:poco-claw:*:*:*:*:*:*:*:*) is a Python-based AI agent executor framework. The vulnerability resides in executor_manager/app/api/v1/workspace.py within the get_workspace_file function, which accepts a user_id argument and performs a file lookup without verifying that the requesting caller is authorized to access that user's workspace. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR) flaw: the application uses a user-supplied key directly as an object reference without enforcing an ownership or authorization check. The PR diff confirms that the executor manager's control-plane routes had no authentication whatsoever prior to the fix - no X-Internal-Token header, no bearer token validation - meaning the Workspace API was externally reachable and accepted any user_id value.
RemediationAI
Upgrade poco-claw to the version containing commit 67fcc88505c57f77d3fcf04eb5b89425b10cbf48, available via GitHub PR #135 (https://github.com/poco-ai/poco-claw/pull/135). The fix adds X-Internal-Token header enforcement on executor manager control-plane routes and callback Bearer token validation on executor proxy routes, effectively requiring authenticated callers. Note that the fix references a commit rather than a tagged release version, so a released patched package version is not independently confirmed from available data - verify with the upstream repository for a tagged release. As an interim workaround, restrict network access to the executor manager service so that it is not reachable from untrusted networks or external clients; placing the executor manager behind an internal network boundary or API gateway with IP allowlisting would prevent unauthenticated external exploitation. The trade-off of network restriction is operational: legitimate internal callers must remain on the allowlist.
Server-side request forgery in poco-ai/poco-claw up to version 0.5.4 allows remote unauthenticated attackers to coerce t
Missing authentication on the executor_manager control-plane API in poco-ai/poco-claw through version 0.5.4 allows adjac
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today